Security & Compliance

1. Security Commitment

SendItFast AI is committed to maintaining the highest standards of security and data protection. Our security program is designed to align with industry best practices and recognized frameworks, including the AICPA SOC 2 Trust Service Criteria across all five principles: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

This document outlines our security practices, controls, and organizational commitments to protecting customer data. We continuously review and enhance our security posture to address evolving threats and maintain the trust of our customers.

─────────────────────────────────────────────────

2. SOC 2 Trust Service Criteria Alignment

Our security controls are designed to align with the SOC 2 Trust Service Criteria established by the American Institute of Certified Public Accountants (AICPA). We implement comprehensive measures across all five trust principles:

2.1 Security (Common Criteria)

We implement comprehensive controls to protect systems and data against unauthorized access:

• Access Control: Role-based access control (RBAC) with principle of least privilege, ensuring users have only the access necessary for their functions
• Authentication: Industry-standard authentication protocols with secure token management and multi-factor authentication support
• Session Management: Secure session handling with automatic expiration and token rotation
• Network Security: Web Application Firewall (WAF), DDoS protection, and network segmentation
• Logging & Monitoring: Comprehensive audit logging of all system activities with real-time alerting for security events
• Vulnerability Management: Regular vulnerability scanning, penetration testing, and timely patching

2.2 Availability

Our infrastructure is designed for high availability, resilience, and fault tolerance:

• Infrastructure: Cloud-hosted on enterprise-grade infrastructure with multi-region redundancy
• Uptime Commitment: 99.9% availability target with continuous monitoring
• Disaster Recovery: Automated backups with geographic redundancy and point-in-time recovery capability
• Incident Response: Documented incident response procedures with defined escalation paths and communication protocols
• Capacity Planning: Proactive capacity monitoring and auto-scaling to handle demand fluctuations

2.3 Processing Integrity

We ensure data is processed completely, accurately, and in a timely manner:

• Input Validation: Comprehensive validation and sanitization of all user inputs
• Error Handling: Robust error handling prevents data corruption and ensures graceful degradation
• Job Processing: Reliable queue-based processing with status tracking, retry mechanisms, and idempotency
• Data Integrity: Database integrity constraints, transaction management, and consistency checks
• Quality Assurance: Automated testing, code reviews, and deployment validation

2.4 Confidentiality

Customer data confidentiality is protected through multiple layers of controls:

• Encryption at Rest: AES-256 encryption for all stored data, including databases and file storage
• Encryption in Transit: TLS 1.2 or higher for all data transmission, with HSTS enforcement
• Access Logging: All data access is logged, monitored, and auditable
• Data Segregation: Strict logical separation of customer data with row-level security
• Secure File Handling: Uploaded files are encrypted and automatically deleted after 30 days
• Key Management: Secure key storage and rotation practices

2.5 Privacy

Personal information is handled in accordance with our Privacy Policy and applicable regulations:

• Data Minimization: We collect only the data necessary to provide our services
• Purpose Limitation: Data is used only for stated and legitimate purposes
• User Rights: Full support for data access, correction, deletion, and portability requests
• Consent Management: Clear and informed consent mechanisms for data processing
• Privacy by Design: Privacy considerations embedded in our development process

─────────────────────────────────────────────────

3. Technical Security Controls

3.1 Infrastructure Security

• Hosted on SOC 2 Type II certified cloud infrastructure
• Private network architecture with strict firewall rules and security groups
• Regular security patching and updates with minimal downtime
• Immutable infrastructure deployments with infrastructure-as-code
• Container security with image scanning and runtime protection
• Network traffic monitoring and intrusion detection

3.2 Application Security

• Secure Software Development Lifecycle (SSDLC) practices
• Input validation, output encoding, and parameterized queries
• Protection against OWASP Top 10 vulnerabilities
• Rate limiting, abuse prevention, and bot detection
• Secure API design with authentication on all endpoints
• Content Security Policy (CSP) and other security headers
• Dependency vulnerability scanning and management
• Static and dynamic application security testing

3.3 Data Security

• All database connections encrypted with TLS
• Secrets management using secure vault solutions
• No sensitive data (PII, credentials) in application logs
• Payment data processed exclusively by PCI-DSS Level 1 certified providers
• Secure credential handling and rotation policies
• Data classification and handling procedures

─────────────────────────────────────────────────

4. Organizational Security

4.1 Security Policies and Governance

We maintain and enforce comprehensive security policies covering:

• Information Security Management
• Acceptable Use Policy
• Access Control Policy
• Incident Response Policy
• Business Continuity and Disaster Recovery
• Vendor and Third-Party Risk Management
• Data Classification and Handling
• Change Management
• Asset Management

4.2 Personnel Security

• Background checks for employees with access to customer data
• Security awareness training for all employees
• Role-based access provisioning and regular access reviews
• Prompt access revocation upon role change or termination
• Confidentiality agreements and code of conduct

4.3 Third-Party Risk Management

We partner with industry-leading infrastructure and service providers who maintain rigorous security certifications. All vendors and subprocessors are:

• Evaluated for security practices before engagement
• Contractually bound to equivalent security and privacy standards
• Subject to ongoing monitoring and periodic reassessment
• Required to maintain appropriate certifications (SOC 2, ISO 27001, etc.)

4.4 Infrastructure Partners

We utilize a carefully selected set of enterprise-grade infrastructure and service providers. All partners maintain industry-recognized security certifications including SOC 2 Type II, ISO 27001, and other relevant compliance standards.

Our infrastructure partners provide:

• Cloud Computing: Enterprise-grade compute and hosting with global availability
• Data Storage: Encrypted database and file storage with row-level security
• Authentication: Secure identity management with industry-standard protocols
• Payments: PCI-DSS Level 1 certified payment processing
• Monitoring: Security event logging and real-time alerting
• Email: GDPR-compliant transactional email delivery

4.5 Data Enrichment and Research Services

For certain Service features, we may use data enrichment and research services. These services are:

• Evaluated for security practices before engagement
• Contractually bound to equivalent security and privacy standards
• Subject to ongoing monitoring and periodic reassessment
• Required to maintain appropriate certifications and compliance standards

Examples of data enrichment and research service categories include:

• Contact intelligence and sales intelligence platforms (e.g., Apollo, ZoomInfo, Clearbit)
• Data enrichment services (e.g., Clay, Firecrawl, D7)
• Business intelligence sources (e.g., Pitchbook, Crunchbase)

4.6 Online Research Security

All online research activities conducted by SendItFast are designed to comply with security best practices and platform terms of service:

• Rate Limiting: Respect platform rate limits and robots.txt directives
• Lawful Access: Access only publicly available information without circumventing technical protection measures
• Terms Compliance: Conduct research in accordance with platform terms of service and applicable laws
• No Circumvention: Do not bypass authentication barriers, payment walls, or other access controls
• Methodology Review: Regularly review research methodologies for compliance with security and legal requirements
• Logging and Auditing: All research activities are logged and auditable for compliance verification

4.7 Data Locations

Customer data is processed and stored in secure, certified data centers:

• Primary Regions: European Union (Ireland) and United States (Virginia)
• CDN: Global edge network for optimal performance

EU customers' data is primarily processed within the European Union. For data transferred outside EU, we rely on Standard Contractual Clauses (SCCs) and adequacy decisions as appropriate legal transfer mechanisms.

4.8 Online Research Data Flow

When conducting online research, data flows are designed with security and compliance in mind:

• Source Verification: All data sources are verified for public accessibility and terms compliance
• Encryption in Transit: All data transmitted during research activities is encrypted using TLS 1.2 or higher
• Storage Security: Research results are encrypted at rest using AES-256 encryption
• Access Controls: Strict role-based access controls limit who can view research results
• Data Retention: Research data is retained only as long as necessary for intended purpose
• Audit Trail: All research activities are logged for compliance and security monitoring

─────────────────────────────────────────────────

5. Compliance Framework

5.1 GDPR Compliance

We maintain comprehensive compliance with the General Data Protection Regulation (GDPR):

• Data Processing Agreements (DPA) available for all customers
• Privacy by Design and Privacy by Default principles embedded in development
• Full support for all data subject rights
• Data breach notification procedures with 72-hour timeline
• Records of Processing Activities (ROPA) maintained
• Data Protection Impact Assessments (DPIA) performed as required
• Designated Data Protection Officer (DPO) contact

5.2 Additional Compliance

• CCPA/CPRA: Support for California Consumer Privacy Act requirements
• CAN-SPAM: Compliance guidance for email marketing regulations
• CASL: Support for Canadian Anti-Spam Legislation requirements

5.3 Data Retention

We implement clear data retention policies:

• Uploaded files: Automatically deleted 30 days after processing
• Account data: Retained while account is active, deleted upon request
• Audit logs: Retained for 12 months for security purposes
• Transaction records: Retained as required by law (typically 7 years)

─────────────────────────────────────────────────

6. Incident Response

We maintain a formal incident response program to detect, respond to, and recover from security incidents:

• Detection: 24/7 automated monitoring, alerting, and anomaly detection
• Triage: Rapid assessment and classification of incidents by severity
• Response: Documented response procedures with defined roles and escalation paths
• Communication: Customer notification within 72 hours of confirmed data breach, per GDPR requirements
• Containment: Rapid isolation of affected systems to prevent further impact
• Recovery: Restoration of services with verification of integrity
• Post-Incident: Root cause analysis, remediation, and lessons learned

─────────────────────────────────────────────────

7. Business Continuity

Our business continuity program ensures service resilience and rapid recovery:

• Automated daily backups with geographic redundancy
• Point-in-time recovery capability with minimal data loss
• Documented disaster recovery procedures and runbooks
• Regular backup restoration testing and validation
• Recovery Time Objective (RTO) and Recovery Point Objective (RPO) commitments
• Multi-region failover capabilities

─────────────────────────────────────────────────

8. Security Assessments

We regularly assess and improve our security posture through:

• Regular internal security reviews and audits
• Automated dependency vulnerability scanning
• Continuous infrastructure security monitoring
• Code security reviews and static analysis
• Penetration testing by qualified security professionals
• Third-party security assessments
• Bug bounty and responsible disclosure program considerations

─────────────────────────────────────────────────

9. Enterprise Features

For enterprise customers with enhanced security and compliance requirements, we offer:

• Custom Data Processing Agreement (DPA)
• Security questionnaire responses (SIG, CAIQ, custom)
• Dedicated security and support contacts
• Service Level Agreements (SLA) with uptime guarantees
• Custom data retention policies
• Enhanced security controls and monitoring
• Dedicated infrastructure options
• Compliance documentation and audit support

─────────────────────────────────────────────────

10. Responsible Disclosure

We take security vulnerabilities seriously and appreciate responsible disclosure from the security community. If you discover a potential security vulnerability:

• Please report it to security@senditfast.ai
• Provide sufficient details to reproduce the issue
• Allow reasonable time for us to address the vulnerability before public disclosure
• Do not access or modify data belonging to other users

We commit to acknowledging receipt within 48 hours and providing regular updates on our investigation and remediation efforts.

─────────────────────────────────────────────────

11. Security Contacts

Security Team: security@senditfast.ai

Data Protection Officer: dpo@senditfast.ai

Enterprise Security & DPA Requests: enterprise@senditfast.ai

─────────────────────────────────────────────────

12. No Security Guarantees

While we implement comprehensive security controls and measures, you acknowledge that:

• No method of transmission over the Internet or method of electronic storage is completely secure
• SendItFast AI cannot guarantee absolute security or immunity from all threats
• Security measures described in this document do not guarantee that the Service will be free from all security incidents
• You are solely responsible for protecting your own systems and data
• Even with security measures in place, risks exist that are beyond SendItFast AI's control
• You acknowledge and accept all risks associated with using the Service, including security risks

SendItFast AI shall have no liability whatsoever for:

• Any security breach or incident affecting your data
• Any unauthorized access to your account or data
• Any loss, damage, or compromise of your information
• Any consequences resulting from security vulnerabilities or incidents
• Any failure of security measures to prevent unauthorized access or data loss

You release, waive, and forever discharge SendItFast AI from all claims, demands, causes of action, losses, damages, costs, expenses, or liabilities of any kind related to security incidents, breaches, or unauthorized access.

You agree to use to the Service entirely at your own risk and acknowledge that SendItFast AI has no liability for security-related matters whatsoever.