How Safe is My Data?
Here's what we can say, and what we can't.
- Hosting. We use industry-standard cloud infrastructure from reputable providers that hold their own compliance certifications.
- Entrant privacy. We don't give campaign owners entrants' IP addresses. You can still filter entries from the same IP with Actions from User IP in an entry's Actions menu, without exposing the address.
- Fraud protection. Suspicious entries are flagged automatically within about five minutes, so bad emails don't reach your connected mailing lists.
- Roles. If you run a campaign, you're the data controller for your entrants' data and we act as your data processor.
- DPA. Sign our standard Data Processing Agreement online. We don't offer amended or custom versions.
- Deletion. An entrant can ask for their data to be deleted, and we process those requests.
We hold a SOC 2 Type II report and run regular penetration tests. Email security@gleam.io for the report and our latest pen test letter. We'll ask you to agree not to share them outside your company first.
Read our Privacy Policy and Security Policy for the details. You can also see how automatic fraud protection works.