Security and privacy at DMARCmetric
Everything in this article describes the system as it ships today — each claim maps to how the product is actually built, not to a roadmap. This article covers current practice in plain language; for the full statement, see our Privacy Policy.
Your account and sign-in
- Sessions live on the server, in a cookie — not tokens in the browser. When you sign in, DMARCmetric sets a session cookie backed by a server-side session record. That makes sessions genuinely revocable: signing out invalidates the session on the server, immediately. There is no JWT sitting in localStorage for a rogue script to steal.
- Cookies are flagged Secure — they are only ever sent over HTTPS.
- Email verification is required. You cannot sign in until the address on your account is verified, so an account cannot be operated from an email its owner never confirmed.
- Authentication endpoints are rate-limited. Sign-in, sign-up and password-reset requests have hard per-window limits, and the counters are stored in the database so limits survive restarts.
- Passwords are hashed by the authentication library (better-auth) and are never stored or logged in plain text.
What your data is — and is not
- Aggregate DMARC reports carry no message content. This is a property of the format itself: an RUA report is counts, IP addresses and authentication results. No bodies, no subject lines, no recipient addresses ever reach us, because reporters never send them. Exactly what we do store from each report is detailed in How long is my data kept?
- We hold no payment data. There is no billing system in the product — we never see, transmit or store a card number.
- Your workspace's data is scoped to your workspace. Every API query that reads report data is tenant-scoped: it filters by your workspace's identity taken from your server-side session, never from anything the browser merely claims.
Where your data lives
- Hosting is in Germany. The service runs on Hetzner infrastructure in Germany (an EU member state), behind Cloudflare.
- Web traffic goes through Cloudflare and is TLS-encrypted between your browser and the service.
- IP geolocation happens inside our own database. The country view is powered by a GeoLite2 dataset loaded into our PostgreSQL instance, so resolving a sender's IP to a country is a local SQL lookup. Your senders' IP addresses are not sent to any third-party geolocation service.
Small design choices that add up
- Unsubscribe links fail closed. Digest unsubscribe tokens are HMAC-SHA256-signed and strictly validated, including a constant-time comparison. If the signing secret were ever missing or too weak, the endpoint disables itself entirely rather than accept anything questionable.
- Opening an unsubscribe link never changes anything by itself. The link shows a confirmation page; the change happens only when you explicitly confirm. Email scanners that prefetch links cannot unsubscribe you by accident.
- Unsubscribing touches one database field — your workspace's report cadence. No external suppression list is involved, which is also why re-enabling digests from your settings works instantly.
What we do not claim
We would rather publish a short list of true statements than a long list of impressive ones. So, plainly: DMARCmetric does not currently hold SOC 2 or ISO 27001 certification, and we make no certification claims around GDPR — this article simply describes how the system handles your data today. Our Privacy Policy sets out the same practices in a formal statement, including our sub-processors and your GDPR rights.
If anything here does not answer your question, the support box below reaches a human. For the wider picture of what the product does with your reports, see What is DMARCmetric?