Security

Infrastructure, encryption, access controls, backup and incident response — how Droppoint protects your business email.

Infrastructure

Our primary mail infrastructure runs in Singapore, on dedicated (non-shared) mail platforms — not general-purpose shared web hosting. Encrypted backups are kept in a separate region.

Encryption

Mail is transmitted with TLS 1.2 or higher wherever the receiving server supports it, and mailbox data is encrypted at rest on disk.

Authentication support

SPF, DKIM and DMARC are configured for every domain. MTA-STS and TLS-RPT are also supported for enforcing and reporting on transport encryption.

Access controls

Two-factor authentication (2FA) is available on every plan. Admins can view and revoke active sessions per mailbox, and IP allow/deny policy is available at the domain level.

Backup

Mail is backed up automatically every 24 hours. Retention windows vary by plan: Starter 14 days, Business 30 days, Enterprise 90 days. See our Pricing page for full plan details.

Incident response

Security incidents affecting customer data are investigated immediately on discovery. Affected customers are notified as soon as we have verified facts to share, alongside status updates at status.droppoint.xyz.

Responsible disclosure

Found a security issue? Contact security@droppoint.xyz. We aim to acknowledge reports within 48 hours and will work with you on a reasonable disclosure timeline.

Sub-processors

We use a small number of infrastructure and monitoring sub-processors to operate the service (e.g. our data-centre provider and an uptime-monitoring service). A full current list is available on request to security@droppoint.xyz.

Data location

Customer mail data is stored on infrastructure based in Singapore, with encrypted backups retained in a separate region.

Compliance stance

Droppoint follows general data-protection best practices and can support data-subject access and deletion requests on request. We do not yet hold formal third-party certifications (e.g. SOC 2, ISO 27001) — this work is in progress and we will publish updates here as it completes.