Skip to content

Security

Effective Date: October 14, 2026  ·  Version: 1.3

This page explains the Technical and Organisational Measures (TOMs) sevk applies to protect customer data, delivered as a complement to our Privacy Policy, Data Processing Addendum (DPA), and Subprocessors list.

1. Infrastructure & Hosting

We use cloud hosting, access controls and network protection to safeguard customer data. Providers and processing locations are listed on our Subprocessors page.

2. Processing Locations

Outgoing email is processed in the sending region selected for each domain. Provider locations are listed on our Subprocessors page.

Other providers may process relevant data in different countries. International transfer safeguards are described in Privacy Policy Section 6.

3. Encryption

  • In transit: public web services use HTTPS; managed database and cache connections use TLS.
  • At rest: primary data storage and stored application secrets are encrypted.
  • Email authentication: outgoing email uses DKIM authentication.
  • Credentials: access to service credentials is restricted to authorized services and personnel.

4. Access Control & Authentication

  • Customer accounts: password or supported third-party sign-in, with optional two-factor authentication.
  • Project access: roles and permissions control access to each project. API keys can be restricted by permission and domain.
  • Personnel access: access is limited to authorized personnel according to their responsibilities.
  • Abuse prevention: automatic bounce and complaint suppression helps protect email delivery.

5. Data We Store on Your Behalf

We process contact lists, email content, attachments, and delivery activity to provide the service on your instructions. Data categories and purposes are described in Privacy Policy Section 2.

Open and click tracking follows your settings for each domain, broadcast, or individual email request. We do not store IP addresses alongside individual tracking events or enrich or resell contact lists. Shared complaint suppression may prevent sending to an address across projects.

6. Retention

Retention periods, backup limits, and deletion procedures are described in Privacy Policy Section 7 and DPA Section 9.

7. How sevk Personnel Access Customer Data

Authorized personnel may access customer data for the following purposes:

  • Support: when a customer opens a ticket and explicitly asks us to look at a specific record.
  • Abuse and deliverability: investigating suspected violations of our Acceptable Use Policy (phishing, spam, malware) that put the platform's sending reputation at risk.
  • Legal obligation: responding to a valid court order or regulatory request; we aim to notify the affected customer where legally permitted.

We do not sell customer data or train our own models on email content. Optional AI drafting sends the requested draft context to the providers described at /subprocessors.

8. Monitoring & Audit

  • We monitor service availability, errors, and email delivery to investigate issues and prevent abuse.
  • Administrative activity in the platform and authenticated email sending are recorded for review.
  • Dashboard diagnostics and related data use are described in our Cookie Policy.

9. Vulnerability Disclosure & Incident Response

Security researchers can report vulnerabilities to support@sevk.io. We aim to acknowledge reports within a few business days and do not pursue legal action against good-faith researchers who follow coordinated disclosure.

After becoming aware of a personal data breach affecting Customer Data, we notify the affected customer without undue delay, with a target of 48 hours where feasible. That target does not permit delaying an earlier notification while an investigation continues. The controller separately assesses authority and individual notification duties; the GDPR authority-notification period is, where applicable, 72 hours after awareness. See DPA Section 7.

10. Compliance Posture

  • GDPR (EU) and KVKK (Turkey): sevk operates as a Data Processor for customer-controlled data (audiences, email content, tracking). See our Privacy Policy and DPA.
  • Cross-border transfers: the applicable mechanism must be established for each transfer and processing role under GDPR and KVKK separately. Provider terms are referenced at /subprocessors.

11. Contact

For security, privacy, or DPA requests, contact support@sevk.io.