1. Our approach
Security is built into how MailToucan is designed and operated. This page summarises our measures. It is not a contractual promise of any specific certification; contractual commitments are in the Terms and DPA.
2. Data protection
- Encryption in transit (TLS) for all connections to the platform and portals.
- Encryption at rest for stored data.
- Customer Data is logically separated by account; we never share one customer’s data with another.
- Payment card data is handled by our PCI-DSS-compliant payment provider and never stored by us.
3. Infrastructure and network
- Hosting with reputable infrastructure providers (see sub-processors).
- Web application firewall, DDoS protection and bot management through Cloudflare.
- Geographic and risk-based access controls to reduce fraud and abuse.
4. Access control
- Production access limited to authorised personnel on a least-privilege basis.
- Strong authentication and access logging for administrative systems.
- Role-based access inside your account so you control who on your team sees what.
5. Email security and deliverability
Email is sent through authenticated infrastructure supporting SPF, DKIM and DMARC. Every address is verified at capture, and every marketing email carries an unsubscribe link.
6. Privacy and consent by design
WiFi portals include explicit consent checkboxes, a privacy-policy link and a clear explanation of how data will be used. Consent records are stored with each contact. You can export or delete contact data at any time.
7. Data location and transfers
We serve customers worldwide and use international safeguards for cross-border transfers (see the Privacy Policy).
8. Backups and continuity
Data is backed up regularly and recovery procedures are reviewed. Deleted data rolls off backups on a rolling schedule.
9. Incident response
We monitor for incidents, investigate promptly, and notify affected customers without undue delay and, where required, within 72 hours.
10. AI and your data
Tou-can uses Google Gemini through its API. We send only the data needed for a request and we do not use your Customer Data to train third-party models.
11. Reporting a vulnerability
See our Responsible Disclosure Policy or email hello@mailtoucan.com.
Questions? Contact hello@mailtoucan.com. See all legal documents.