Security
We make two promises: your data stays in your AWS account, and you can switch our access off right away. The docs security page gives the control behind each claim, the test that checks it, and how you can check it yourself.
Your contacts and history live in your AWS account
- Contacts, consent records, send history and events are stored in your DynamoDB tables and S3 buckets, which the template creates in your account.
- Our service reads and writes them in memory to do what you ask, such as sending a campaign or importing a list. None of it is written anywhere on our side.
- Our queues hold IDs only: which client, campaign, batch or event. Never an address or the content of an email.
- Sending events pass through our event bus in memory and are cut down to IDs, times and flags before they reach our queue. The IP address of an open never reaches us.
You can switch us off right away, and every call we make shows in your CloudTrail
- We reach your account only through one role you create in your account. It has full control of what the template creates for us, plus Amazon SES. It can't change the template's IAM roles, your CloudTrail trail or the stack itself.
- Set the template's Disconnect option, or delete the stack, and our access ends right away. Your account also stops sending events to us. Your tables and buckets are kept either way.
- Every session we open in your account appears in your CloudTrail, labeled with the part of our service that opened it. Turn on data events to see every individual read and write.
- Your data is already in your account, so you can leave whenever you like and keep all of it.
One client can't reach another
- Each client's data lives in its own AWS account, and each account belongs to one client.
- Every request's client is fixed from its API key, and every event's from the AWS account it came from. Nothing in a request can pick another client.