Information security
Security handbook
This is the policy set behind our information security management system (ISMS), authored to the ISO/IEC 27001:2022 control framework. We publish it in full rather than gate it behind a request — what we commit to internally is what you can read here.
Policies are reviewed at least annually and after any material change. For the controls these policies sit on top of, see the Trust Center. Signed PDF copies for a security questionnaire are available from [email protected].
Governance
- Information Security PolicyThe umbrella policy stating how Mailbuttons protects the confidentiality, integrity and availability of customer email and platform data.
- Risk Management PolicyHow Mailbuttons identifies, assesses, treats and accepts information-security risks through a maintained risk register.
- Asset Management PolicyHow Mailbuttons inventories its information assets, assigns ownership, controls access on a least-privilege basis, and securely retires assets.
- Data Classification and Retention PolicyHow Mailbuttons classifies information, handles each tier, and retains then securely deletes data in line with GDPR principles.
People & Access
- Human Resources Security PolicyHow Mailbuttons embeds information security into the people lifecycle from hiring through offboarding.
- Acceptable Use PolicyThe rules everyone must follow when using Mailbuttons systems, data, devices and AI tools.
- Access Control PolicyHow Mailbuttons grants, restricts and reviews access to systems, data and customer tenants.
- Cryptography PolicyThe cryptographic standards and key management practices Mailbuttons uses to protect data in transit and at rest.
Operations & Engineering
- Secure Development PolicyHow Mailbuttons designs, builds and reviews software so that security is engineered in rather than bolted on.
- Change Management PolicyHow changes to Mailbuttons production systems are tracked, reviewed, tested, deployed and rolled back.
- Vulnerability and Patch Management PolicyHow Mailbuttons identifies, prioritises, remediates and discloses security vulnerabilities across its software and infrastructure.
- Logging and Monitoring PolicyWhat Mailbuttons logs, how those logs are protected and retained, and how they are monitored and used to detect and investigate incidents.
Resilience & Suppliers
- Incident Response PolicyHow Mailbuttons identifies, reports, manages and learns from security incidents and personal data breaches.
- Business Continuity and Disaster Recovery PolicyHow Mailbuttons keeps service running and recovers data and systems after disruption, with defined recovery objectives.
- Supplier Security PolicyHow Mailbuttons selects, contracts with, monitors and offboards suppliers and sub-processors that handle its data.
- Physical and Environmental Security PolicyHow Mailbuttons addresses physical and environmental security through supplier reliance and endpoint hygiene as a remote micro-team.