Your email-security data is handled with care.
Learn how SpoofWard protects your account, separates customer workspaces, handles security data, and gives you control over your information.
- Encrypted connections
- Workspace isolation
- Role-based access
- Two-factor authentication
Last reviewed: September 17, 2026
How your account and data are protected
Six controls that are in place in SpoofWard today.
Secure connections
SpoofWard uses HTTPS to protect information travelling between you and the platform, and tells browsers to always connect securely.
Workspace isolation
Customer domains, reports, settings and team access are separated by workspace, and every request is checked against the workspace you belong to.
Protected credentials
Mailbox passwords, DNS-provider credentials, SIEM and chat-integration access tokens, and managed DKIM private keys are encrypted before storage. Account passwords and API tokens are kept only as one-way hashes.
Role-based permissions
Each workspace member has a role — owner, admin, analyst or viewer — that controls what they can view, manage, export or change. The workspace owner assigns the roles.
Two-factor authentication
Available to every user. Owners and admins must have it switched on before sensitive actions such as publishing DNS changes, creating API tokens or deleting a workspace.
Security audit trail
Important account and security actions are recorded in a tamper-evident log. Owners and admins can review and export it on plans that include the audit log.
What we hold, and the control you have over it
SpoofWard works mostly with statistics about email authentication, not with the email itself.
DMARC reports are statistics, not email
DMARC aggregate reports contain authentication statistics — sending servers, message counts, pass or fail results — not email bodies. Message bodies are never retained as part of DMARC reporting.
Forensic reports are minimised
Forensic (failure) reports are optional and may include limited details from a real message. SpoofWard never stores the body, shortens the subject, masks recipients and encrypts these fields. By default only owners and admins can read them, and every view is logged. Treat what remains as personal data.
You can export and delete your data
Any user can export their account information, and report data can be exported on plans that include export. A workspace owner can permanently delete the workspace with its domains, reports and settings; removal from our live systems is immediate. Routine backups are kept for up to 12 months and age out on that schedule.
Retention follows your plan
How long reports and scan history are kept depends on your plan. If a workspace moves to a plan with a shorter window, older history is deleted, so export anything you need first.
About encryption. Sensitive credentials and selected sensitive fields are encrypted before storage. Data is encrypted in transit using HTTPS. We do not currently claim encryption at rest for the full database or its backups.
If something goes wrong. If we identify a security incident that affects your workspace, we aim to notify the workspace owner by email with what we know and what we are doing about it.
For the full legal details, read the Privacy Policy.
What SpoofWard does and does not do
SpoofWard watches and reports on email authentication. The mailbox providers that receive your mail apply the DMARC policy you publish.
SpoofWard does
- Monitor DMARC authentication results
- Analyze SPF and DKIM alignment
- Detect DNS and authentication changes
- Help you progress safely toward DMARC enforcement
- Provide reports, recommendations and alerts
Standard DMARC monitoring does not
- Sit directly inside your mail flow
- Deliver your email
- Delete your messages
- Independently block messages
Mail Shield is different. When Mail Shield is separately enabled, it can scan a connected mailbox and optionally move suspicious messages into a quarantine folder inside that mailbox. This is different from SpoofWard's standard DMARC-monitoring service.
From that folder you can release a message back to the inbox or delete it; SpoofWard does not delete mail on its own. Mail Shield keeps the sender, recipient, subject line and scan result of each scanned message — never bodies or attachments — until you remove the mailbox or the workspace. Scanning runs on SpoofWard's own servers, not a third-party service.
Service providers we rely on
The providers SpoofWard uses in production, what each one is for, and the data it handles.
| Provider | Purpose | Data involved | Optional? |
|---|---|---|---|
| Hosting provider (European Union) | Servers, database and backups. Name available on request for customer security assessments. | All customer data held by SpoofWard | No |
| Cloudflare | Network protection and delivery for spoofward.com; DNS for SpoofWard's own domains. | IP address and web request data | No |
| Lemon Squeezy | Payments, invoices and sales tax, as Merchant of Record. | Billing name, email and payment details. Card details never reach SpoofWard. | Paid plans only |
| Google Workspace | Sends notification, alert and report emails. | Recipient address and email content | No |
| Google sign-in | Sign in with a Google account instead of a password. | Name and email address from Google | Yes, only if you choose it |
| Have I Been Pwned | Checks new passwords against known breaches; powers Breach Monitor where used. | A partial, anonymised password fingerprint, never the password. Breach Monitor sends the email addresses you ask it to check. | Password check always on; Breach Monitor optional |
| OpenAI | Not currently enabled. Weekly insights are produced by SpoofWard's own rules. | None. No data is sent. | Not in use |
| Google Analytics | Usage statistics on the website and in the application. | IP address, pages viewed and browser details | Cookieless until you accept cookies |
| Microsoft Clarity and RB2B | Public marketing website only: session replays (Clarity) and identifying a visitor's company (RB2B). Never on sign-in pages or inside your workspace. | IP address, pages viewed and on-page interaction | Yes, only after you accept cookies |
| Script and font delivery networks | Deliver scripts and fonts to your browser (jsDelivr, unpkg, d3js.org, TinyMCE, Google Fonts, Bunny Fonts). | IP address and browser request data | No |
Integrations you connect yourself — such as Slack, Microsoft Teams, Splunk, Microsoft Sentinel, webhooks or your DNS provider — receive only what you configure them to receive. We do not yet offer a signed data-processing agreement or advance notice of subprocessor changes; this list is maintained by hand and is accurate as of the review date above.
Current assurance status
- SOC 2 Not currently certified
- ISO 27001 Not currently certified
- Independent penetration test Not yet completed
- Public status page Not currently available
- Uptime percentage Not published
We publish only security claims we can support. These items will be updated when the relevant audits, testing, or monitoring become available.
Found a security problem? Tell us.
Write to [email protected]. The same details are published at /.well-known/security.txt.
How to report
Email [email protected] with the page or endpoint, the steps you took and what you observed.
Safe harbour
We will not take or support legal action against anyone who tests in good faith within these limits, reports privately to us, and gives us a reasonable chance to fix the issue before disclosing it.
Please stay within these limits
Test only accounts and domains you control. Do not access, change or keep another customer's data. No denial-of-service, load testing, social engineering or mass automated scanning.
What to expect
We aim to acknowledge a report within five business days and share our assessment within fifteen. These are targets, not guarantees. We do not run a paid bug-bounty programme, but gladly credit you when a fix ships.