Email Security Posture Management (ESPM)ESPMBack to home

Privacy Policy

Last updated: 2026

This policy describes how ESPM (Email Security Posture Management), operated by NullFortis ("ESPM," "we," "us"), actually handles data based on how the product works today. It's provided as a working starting point — have it reviewed by qualified legal counsel before relying on it as your organization's official policy.

1. Information we collect

Account information

When you register, we collect your name, email address, and password (stored only as a salted bcrypt hash — we never see or store your plaintext password). Optional profile settings include an avatar URL, timezone, language, and light/dark theme preference. If you enable multi-factor authentication, we store an encrypted MFA secret.

Organization information

Every account belongs to at least one organization (workspace), which has a name, plan, and a list of members with roles (owner, admin, member). Organization owners/admins can invite teammates by email.

Domain and email-authentication data

For each domain you add, we store the domain name, its DNS verification status, and the DMARC, SPF, and DKIM records we look up or that you upload. DMARC aggregate ("RUA") reports contain metadata about mail claiming to be from your domain — sending IP addresses, message volume, and pass/fail/alignment results. Aggregate reports never contain the body, subject, or content of any actual email — that's a structural property of the DMARC specification itself, not just our processing choice.

Integration credentials

If you connect a third-party integration (Cloudflare, Slack, PagerDuty, SendGrid, Microsoft 365, Google Workspace, AWS Route 53, Amazon SES, or a shared IMAP mailbox), we store whatever credential that provider requires (API token, webhook URL, or mailbox password) encrypted at rest. These credentials are used solely to operate the integration you configured.

Usage and log data

We log sign-in timestamps, the IP address of each login and report submission, and an audit trail of sensitive account/organization actions. Session tokens (access and refresh tokens) are stored in your browser's local storage, not in third-party tracking cookies.

2. How we use this information

  • To operate the service: parsing DMARC reports, computing compliance grades, running DNS lookups, and generating trend charts.
  • To send transactional email you’ve asked for or that keeps your account secure: email verification, password reset, and organization invitations.
  • To generate AI-assisted, plain-English explanations of authentication failures. Only aggregate authentication-decision metadata (never email content) is sent to our AI provider for this purpose — see “Subprocessors” below.
  • To detect abuse, enforce our Terms of Service, and keep the platform secure.

3. Subprocessors and third parties

We don't sell your personal information. Limited data is shared with:

  • Anthropic — processes aggregate authentication-decision metadata to generate the AI explanations described above.
  • Our email delivery provider (SMTP) — delivers verification, password-reset, and invitation emails on our behalf.
  • Any integration you personally connect (Cloudflare, Slack, PagerDuty, etc.) — data only flows to these when you explicitly enable them, and only as needed for that integration to function.

4. Data security

Passwords are hashed with bcrypt and never stored in plaintext. Every stored integration credential is encrypted at rest. We support optional multi-factor authentication, and API access is scoped to individually revocable, per-organization API keys. Each organization's data is isolated from every other organization on the platform.

5. Data retention

We retain account and organization data for as long as your account is active, and DMARC report history for as long as needed to power trend analysis — you can clear an organization's stored reports at any time from Settings. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we're required to retain it for legal or security purposes.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us using the details below.

7. Children's privacy

ESPM is a business tool and is not directed at, or knowingly used to collect information from, children under 16.

8. Changes to this policy

We'll update the "last updated" date above whenever this policy changes, and will make reasonable efforts to notify account owners of material changes.

9. Contact us

Questions about this policy or your data can be sent to [email protected].