Security at DMARCHub

DMARCHub is hosted in Microsoft Azure UK South. All customer data - DMARC reports, account information, payment metadata - stays in the UK. We do not transfer customer data outside the UK or EEA.

All data is encrypted at rest using AES-256 (managed by Azure Storage). All traffic between you and DMARCHub is over TLS 1.2 or higher. Traffic between our worker and Microsoft Graph (for mailbox access) is over TLS 1.3.

Sign-in goes through Microsoft Entra (OAuth 2.0) or Google Workspace (OIDC). DMARCHub never sees, stores, or processes your password. We support any Entra tenant and any Google Workspace domain: your existing identity provider and its MFA and conditional access policies apply.

Card details go straight to Stripe via their hosted Checkout. DMARCHub never sees raw card data, which keeps us SAQ A (the lightest PCI compliance bracket). Stripe is PCI DSS Level 1 certified.

Inside Technology Ltd holds Cyber Essentials Plus, the UK government-backed certification with a hands-on technical audit. It covers the five control areas: firewalls and network boundaries, secure configuration, user access control, malware and input protection, and security update management - the same controls DMARCHub is built on.

DMARCHub administrative access is restricted to staff on the office network (allowlisted IP ranges) and gated on a corporate email domain check. Every admin action is recorded in an immutable audit log.

We scan our own dependencies daily against the OSV vulnerability database. New vulnerabilities are triaged in the morning. Critical vulnerabilities trigger an out-of-hours email to the on-call engineer.

Parsed DMARC reports (aggregate and forensic) are physically retained for 3 years so you can review year-on-year trends. How far back you can view in the portal depends on your plan: Free shows 3 months, Starter 12, Pro the full 3 years. Upgrading reveals older history instantly - it was never deleted, only hidden. Forensic reports have personally identifying information scrubbed at the point of ingest. Summary statistics (used by the dashboard) are kept for 5 years. Raw report files (XML/zip attachments) are kept for 30 days. Email audit logs are kept for 36 months. Account data is kept while your account is active.

Closed accounts are soft-deleted for 30 days (recoverable on request) and then permanently torn down. Hard deletion erases all DMARC reports, mailbox data, support content, and personally identifying information, and verifies nothing is left behind. Financial records (invoices) are kept as an anonymised, contact-stripped record for the statutory retention period - around seven years - then deleted.

Operational status, scheduled maintenance, and incident history are published on our status page at dmarchub.io/status. We commit to publishing every incident within 30 minutes of detection.