Security at Veil Mail
Security isn't just a feature—it's the foundation of everything we build. Learn how we protect your data and your customers' data.
PII Protection
Our core security feature automatically scans every email for Personally Identifiable Information before it's sent. This protects your organization from accidentally exposing sensitive data.
How it works
- 1When you send an email through our API or dashboard, the content is scanned in real-time.
- 2Our scanning engine (powered by Google Cloud DLP) identifies potential PII patterns.
- 3Based on your settings, the email is either blocked, sent with a warning, or sent normally.
Data types we detect
Infrastructure Security
Enterprise-grade security at every layer.
Encryption in Transit
All data transmitted to and from Veil Mail is encrypted using TLS 1.2 or higher.
Encryption at Rest
All stored data is encrypted using AES-256 encryption.
API Key Security
API keys are hashed and stored securely. You can revoke keys instantly from the dashboard.
Access Controls
Role-based access control ensures team members only access what they need.
Infrastructure Security
Hosted on Google Cloud Platform with SOC 2 Type II certified infrastructure.
Audit Logging
Comprehensive audit logs track all account activity for compliance and security review.
Compliance
We're committed to meeting the highest compliance standards for data protection and privacy.
GDPR
General Data Protection Regulation compliant. DPA available for EU customers.
CCPA
California Consumer Privacy Act compliant for California residents.
HIPAA
HIPAA-ready infrastructure. BAA available for healthcare customers.
SOC 2
Infrastructure hosted on SOC 2 Type II certified Google Cloud Platform.
Responsible Disclosure
We take security seriously and appreciate the work of security researchers. If you discover a security vulnerability, please report it responsibly.
How to report
- Email security issues to security@veilmail.com
- Include detailed steps to reproduce the vulnerability
- Allow us reasonable time to respond before public disclosure
- Do not access or modify data belonging to other users
Questions about security?
Our team is happy to discuss our security practices and compliance in more detail.