Privacy & Data Governance Policy

DmarcLock Platform · Last updated: September 2026

Technical Data Governance & Architecture Disclosure

This document specifies our technical data handling practices: how RFC 7489 aggregate DMARC telemetry, sender IP addresses, and domain security headers are ingested, stored with a strict 30-day retention lifecycle, and protected against secondary monetization. Note: While engineered to align with global privacy benchmarks (including GDPR data minimization and India's DPDP Act principles), these technical disclosures remain subject to formal review by qualified legal counsel prior to general commercial availability.

01. Scope & Roles

DmarcLock operates as a technical service provider and data processor on behalf of customer organizations that configure DNS authentication and aggregate DMARC reporting. When receiving email security telemetry, we process technical protocol headers strictly on your instruction to defend your domains against spoofing, phishing, and impersonation.

02. DMARC Telemetry & IP Address Data (RFC 7489)

When a domain points its DMARC record (rua=mailto:dmarc-reports+...@ingest.dmarclock.com) to DmarcLock, receiving mail exchangers worldwide (Google Workspace, Microsoft 365, Yahoo, etc.) automatically transmit aggregate XML feedback reports.

Data elements ingested from aggregate reports:

Source IP Address (<source_ip>): The public IP address of the relay transmitting email on behalf of your domain.
Message Volume Counts: The aggregate number of messages observed from that IP address during the report window.
Cryptographic Authentication Verdicts: SPF (pass / fail) and DKIM (pass / fail) status codes.
Policy Disposition: The enforcement action taken by the receiver (none, quarantine, reject).
Header From Domain: The apex domain claimed in the message RFC 5322 From header.

Note: RFC 7489 aggregate reports never contain message subject lines, email body content, sender/recipient mailboxes, or attachments. DmarcLock has zero access to the actual content of your emails.

03. Purpose of Processing & Governance Principles

Our processing of sending IP addresses and email telemetry is strictly bounded by technical security requirements:

Email Security Operations: Processing relay IP addresses is technically required to identify unauthorized infrastructure sending email using your domain identity and to isolate spoofing threats.
Service Delivery: Calculating SPF lookup budgets, identifying legitimate unaligned senders (e.g. Google Workspace, Amazon SES, Klaviyo), and preventing email delivery disruptions during DMARC policy transitions.
Privacy by Design Alignment: Implementing automated 30-day hard purges, optional `/24` subnet truncation masking, and multi-tenant isolation so that telemetry is minimized and stored only as long as operationally necessary.

04. Strict 30-Day IP Retention Lifecycle & Anonymization

Automated 30-Day Hard TTL

In compliance with the Storage Limitation principle (GDPR Art. 5(1)(e)), raw sender IP addresses (DmarcRecord) and XML feedback envelopes are automatically and irreversibly purged from our databases 30 days after ingestion.

Subnet Masking (Zero-PII Mode)

For customers operating under zero-PII regimes, DmarcLock provides automated subnet truncation masking: IPv4 addresses are masked to /24 (e.g., 198.51.100.0/24) and IPv6 to /48, removing individual host identifiers.

Customers may also invoke on-demand telemetry erasure at any time via the "Purge Telemetry" button in the dashboard or via the DELETE /api/v1/dmarc/domains/{domain}/telemetry API.

05. Zero Data Monetization Commitment

We enforce an absolute rule regarding your domain intelligence:

Our Non-Negotiable Privacy Guarantees:

We NEVER sell, rent, or lease your email telemetry, sending volumes, or vendor lists to data brokers, advertisers, or third parties.
We NEVER pool or correlate your sending volume with competitors without explicit, de-identified benchmarking consent.
Telemetry is isolated to your workspace.

06. Multi-Tenant Isolation & Security Measures

DmarcLock employs defense-in-depth engineering to prevent cross-tenant data leaks and infrastructure compromise:

Defused XML Parsing: XML bombs, entity expansions (Billion Laughs), and external DTD injection attacks are immunized via defusedxml.
10MB Decompression Ceiling: Incoming gzip and zip archives are subject to strict 10MB expansion caps and directory traversal validation.
Workspace Authorization: All telemetry endpoints strictly verify authenticated workspace ownership (403 Forbidden on unmapped domains).
Encryption: All telemetry in transit is encrypted using TLS 1.3; database storage is encrypted at rest (AES-256).

07. Subprocessors

Subprocessor	Role	Location
Supabase Inc.	Database hosting & encrypted data storage	AWS (ap-south-1 / eu-central-1)
Cloudflare Inc.	Authoritative DNS resolution & edge protection	Global Anycast Network
Stripe Inc.	Billing & subscription tokenization	United States / Global

08. Data Controller Rights & Contact

Organizations utilizing DmarcLock have full rights under GDPR and DPDP Act 2023 to export, purge, or audit telemetry associated with their verified domains.

Data Protection Officer & Privacy Inquiries

Contact our security and legal compliance desk directly.

privacy@dmarclock.com

Loading…

01. Scope & Roles

02. DMARC Telemetry & IP Address Data (RFC 7489)

Data elements ingested from aggregate reports:

Source IP Address (<source_ip>): The public IP address of the relay transmitting email on behalf of your domain.
Message Volume Counts: The aggregate number of messages observed from that IP address during the report window.
Cryptographic Authentication Verdicts: SPF (pass / fail) and DKIM (pass / fail) status codes.
Policy Disposition: The enforcement action taken by the receiver (none, quarantine, reject).
Header From Domain: The apex domain claimed in the message RFC 5322 From header.

03. Purpose of Processing & Governance Principles

Our processing of sending IP addresses and email telemetry is strictly bounded by technical security requirements:

Email Security Operations: Processing relay IP addresses is technically required to identify unauthorized infrastructure sending email using your domain identity and to isolate spoofing threats.

Service Delivery: Calculating SPF lookup budgets, identifying legitimate unaligned senders (e.g. Google Workspace, Amazon SES, Klaviyo), and preventing email delivery disruptions during DMARC policy transitions.

Privacy by Design Alignment: Implementing automated 30-day hard purges, optional `/24` subnet truncation masking, and multi-tenant isolation so that telemetry is minimized and stored only as long as operationally necessary.

04. Strict 30-Day IP Retention Lifecycle & Anonymization

Automated 30-Day Hard TTL

Subnet Masking (Zero-PII Mode)

Customers may also invoke on-demand telemetry erasure at any time via the "Purge Telemetry" button in the dashboard or via the DELETE /api/v1/dmarc/domains/{domain}/telemetry API.

05. Zero Data Monetization Commitment

We enforce an absolute rule regarding your domain intelligence:

Our Non-Negotiable Privacy Guarantees:

We NEVER sell, rent, or lease your email telemetry, sending volumes, or vendor lists to data brokers, advertisers, or third parties.
We NEVER pool or correlate your sending volume with competitors without explicit, de-identified benchmarking consent.
Telemetry is isolated to your workspace.

06. Multi-Tenant Isolation & Security Measures

DmarcLock employs defense-in-depth engineering to prevent cross-tenant data leaks and infrastructure compromise:

Defused XML Parsing: XML bombs, entity expansions (Billion Laughs), and external DTD injection attacks are immunized via defusedxml.

10MB Decompression Ceiling: Incoming gzip and zip archives are subject to strict 10MB expansion caps and directory traversal validation.

Workspace Authorization: All telemetry endpoints strictly verify authenticated workspace ownership (403 Forbidden on unmapped domains).

Encryption: All telemetry in transit is encrypted using TLS 1.3; database storage is encrypted at rest (AES-256).

Subprocessor

Role

Location

Supabase Inc.

Database hosting & encrypted data storage

AWS (ap-south-1 / eu-central-1)

Cloudflare Inc.

Authoritative DNS resolution & edge protection

Global Anycast Network

Stripe Inc.

Billing & subscription tokenization

United States / Global