Security

CloudNow LLC, a Wyoming limited liability company ("Company", "we", "us", or "our"), operates MailIntel (the "Service"), a cloud-based DMARC analytics and email authentication platform. Protecting the confidentiality, integrity, and availability of the data our customers entrust to us is fundamental to the Service. This page describes the administrative, physical, and technical safeguards we use to protect Customer Data.

This page should be read alongside our Terms of Service available at https://mailintel.io/terms, our Privacy Policy available at https://mailintel.io/privacy, and our Data Processing Addendum available at https://mailintel.io/dpa. A detailed description of our security measures is set out in Appendix 2 of the Data Processing Addendum. In the event of any conflict between this page and the Terms of Service or the Data Processing Addendum, the Terms of Service and the Data Processing Addendum shall control.

Quick Summary — What You Need to Know

• The Service is hosted on Microsoft Azure, and we build on Azure's data center, network, and encryption security as a foundational layer.
• Customer Data is stored in the Azure region you select at signup: NA (United States), LATAM (Brazil), EMEA (Ireland), or APAC (Australia).
• Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest.
• Each customer's data is logically isolated from the data of other customers.
• Customer sign-in is managed through Microsoft Entra ID with multi-factor authentication (MFA).
• Access to Customer Data is limited to authorized personnel on a need-to-know basis, and our personnel use MFA to access our Azure environment.
• We do not process the content of your emails, and we do not use Customer Data to train machine learning models or for advertising purposes.
• Our free DMARC Report Analyzer processes reports entirely in your browser. Reports are not uploaded to our servers.
• To report a suspected vulnerability or security concern, contact privacy@mailintel.io.

1. Our Approach to Security

We implement and maintain a comprehensive written Information Security Program that includes administrative, physical, and technical safeguards designed to protect Customer Data against unauthorized access, use, disclosure, alteration, or destruction. Our Information Security Program is designed in proportion to the nature of the data we process, which consists primarily of email authentication metadata and domain configuration information rather than personal communications.

We designate a security responsible person for the development, implementation, and maintenance of the Information Security Program. We regularly review and update the program to reflect changes in technology, evolving threats, industry standards, and best practices. Any such updates will not materially diminish the protections applicable to Customer Data.

2. Cloud Infrastructure

The Service is hosted on Microsoft Azure. We do not operate our own physical data centers. Physical security of the facilities that host the Service, including access control, environmental controls, and hardware disposal, is provided by Microsoft in accordance with Azure's security and compliance programs.

We leverage Azure's compliance certifications, data center security, network security, and encryption services as a foundational layer of our Information Security Program. Details of Azure's security and compliance posture are available at https://azure.microsoft.com/en-us/explore/trusted-cloud/compliance.

3. Data Residency

Customer Data is stored and processed within the Microsoft Azure region selected by Customer during the signup process:

We use commercially reasonable efforts to maintain Customer Data within the selected region. Customer Data does not leave the selected region except where Customer explicitly requests cross-region functionality or where required by applicable law. The only data transferred to the United States regardless of region selection is aggregated, non-identifiable Telemetry Data, as described in Section 2.3 of our Privacy Policy, which does not constitute Customer Personal Data.

4. Encryption

• Data in transit: all connections to the Website and the Service are encrypted using TLS 1.2 or higher.
• Data at rest: Customer Data is encrypted at rest using industry-standard encryption protocols, leveraging Microsoft Azure's built-in encryption capabilities.
• Payment data: payment card details are processed by our payment processor, Stripe. We do not store full payment card numbers on our systems.

5. Access Controls and Data Segregation

5.1 Internal Access

We maintain policies, procedures, and technical controls to: (a) limit logical access to information systems to authorized personnel only; (b) authenticate and permit access only to authorized individuals; (c) restrict access to Customer Data to personnel who require such access to perform their job duties in connection with the Service; and (d) prevent unauthorized access to Customer Data.

Our personnel are required to use multi-factor authentication (MFA) to access our Microsoft Azure environment and the administrative systems used to operate the Service.

5.2 Data Segregation

We implement logical isolation controls to prevent Customer Data from being accessed by, or commingled with, data belonging to other customers. We maintain such isolation measures throughout the Subscription Term in accordance with industry-standard practices.

5.3 Customer Accounts and Authentication

Customer sign-in to the Service is managed through Microsoft Entra ID, Microsoft's identity and access management platform, with multi-factor authentication (MFA). Each Customer Account is provisioned with unique User IDs. Each User ID is intended for use by a single individual and must not be shared. Customers control which Authorized Users have access to their Account.

6. Personnel Security

All personnel authorized to process Customer Data are subject to appropriate confidentiality obligations. We provide a security awareness and training program for all relevant personnel, including training on how to implement and comply with the Information Security Program and applicable Data Protection Laws.

7. Monitoring, Logging, and Audit

We maintain hardware, software, and procedural mechanisms that record and examine activity in information systems containing Customer Data, including appropriate logs and reports to support compliance monitoring. We monitor our systems for attempted attacks or intrusions. Records of actions taken within Customer Accounts are maintained for security and audit purposes.

We regularly test key controls, systems, and procedures of the Information Security Program to ensure they are effective. Customers may request information reasonably necessary to demonstrate our compliance with our data protection obligations, and may exercise audit rights, as described in Section 9 of the Data Processing Addendum.

8. Business Continuity and Backups

We maintain policies and procedures for responding to emergencies or events that may damage Customer Data or related systems, including a data backup plan and a disaster recovery plan. We leverage Microsoft Azure's redundancy and disaster recovery capabilities as part of these plans.

We also maintain policies and procedures governing hardware and electronic media containing Customer Data, including procedures for the secure disposal and destruction of Customer Data and the media on which it is stored.

9. Incident Response and Notification

We maintain documented policies and procedures to detect, respond to, and address Security Incidents, including: monitoring systems for attempted attacks or intrusions; identifying and responding to suspected or known Security Incidents; mitigating harmful effects; and documenting Security Incidents and their outcomes.

Upon becoming aware of a confirmed Security Incident affecting Customer Data, we will notify affected Customers without undue delay and in accordance with applicable law and the timeframes set out in Section 6.3 of our Terms of Service. We will provide available information about the nature of the Security Incident, including the categories and approximate volume of Customer Data affected to the extent known, and will take reasonable steps to identify the cause, minimize harm, and prevent recurrence.

10. Data Retention and Deletion

The period of Customer Data history accessible within the Service (the "Active Retention Period") varies by subscription tier, as set out in our Plan Features Schedule at https://mailintel.io/pricing. Following termination or expiration, Customer Data is retained for thirty (30) days to allow data export, then deleted or anonymized. Backup copies may persist for up to an additional ninety (90) days and are deleted in the ordinary course of backup rotation. Upon Customer's written request, we will provide written confirmation of deletion. Full details are set out in Section 5.9 of our Terms of Service and Section 11 of our Data Processing Addendum.

11. Subprocessors

We engage a limited number of Subprocessors to help us deliver the Service. Each Subprocessor is bound by a written agreement imposing data protection obligations no less protective than those in our Data Processing Addendum, and we remain responsible for their acts and omissions. Our current Subprocessors are:

A complete and up-to-date list of our Subprocessors is maintained at https://mailintel.io/subprocessors. We will notify Customers of any addition or replacement of a Subprocessor at least thirty (30) days prior to engagement, in accordance with Section 6.2 of our Data Processing Addendum.

12. Free Tools

Our free DMARC Report Analyzer, available at https://mailintel.io/tools/dmarc-analyzer, processes DMARC aggregate reports entirely within the user's web browser. Reports selected for analysis are not uploaded to, stored on, or processed by our servers. PDF exports generated by the tool are created locally by the user's browser.

13. Shared Responsibility

Security of the Service is a shared responsibility. While we are responsible for securing the Service and its underlying infrastructure, Customer is responsible for:

• Securing its own systems, networks, and devices used to access the Service;
• Managing and protecting all User credentials, including MFA methods, and ensuring that User IDs are not shared;
• Configuring appropriate access controls within the Service and removing access for Users who no longer require it;
• Promptly rotating credentials and notifying us if Customer suspects any unauthorized access to its Account; and
• Independently assessing whether our security measures meet Customer's requirements and legal obligations.

These responsibilities are set out in full in Section 6.2 of our Terms of Service and Section 7.3 of our Data Processing Addendum.

14. Compliance and Certifications

Our data protection commitments are designed to support Customers' obligations under applicable Data Protection Laws, including the GDPR, the LGPD, and the CCPA, as described in our Privacy Policy and Data Processing Addendum. For transfers of personal data subject to European Data Protection Laws, the Standard Contractual Clauses are incorporated into our Data Processing Addendum.

The Service is hosted on Microsoft Azure, which maintains a broad portfolio of independently audited compliance certifications. We do not currently hold independent security certifications of our own. We will pursue formal security certifications as the business matures and will update this page accordingly.

15. Reporting a Security Issue

If you believe you have discovered a security vulnerability in the Service or the Website, or if you suspect unauthorized access to your Account, please contact us at privacy@mailintel.io with the subject line 'Security Report'. Please include a description of the issue, the steps required to reproduce it, and any relevant details that will help us investigate.

We ask that you: (a) give us reasonable time to investigate and address the issue before disclosing it publicly; (b) make a good-faith effort to avoid accessing, modifying, or deleting data belonging to others; and (c) avoid any activity that could degrade or disrupt the Service. We will acknowledge receipt of your report and keep you informed of our progress where appropriate.

Contact Information

For questions regarding our security practices, please contact:

© 2026 CloudNow LLC. All rights reserved.