ZTD OfficeSecurity & privacy
How we look after your email
Plain answers about where your email is kept, how it’s protected and what we do when something goes wrong.
Where your email is stored
Your mailboxes, calendars and contacts are stored on our own mail servers, hosted by Hetzner in Helsinki, Finland (EU). Outgoing email is delivered through Amazon Simple Email Service (SES) infrastructure in the EU, via our delivery partner Resend, and moves to our own Amazon SES account in London during the pilot. Your email stays in the UK and EU.
Encrypted in transit
Webmail, the control panel, and the connections from your email apps (IMAP and SMTP) all use TLS encryption. When another mail server supports it, email between servers is encrypted too. We publish an MTA-STS policy so other servers know to expect encryption.
Two-factor sign-in
The control panel supports two-factor sign-in with an authenticator app. It’s required for all ZTD Office staff, and available to every client admin. Admin access to the mail servers themselves uses SSH keys, not passwords.
SPF, DKIM and DMARC
We set up these email authentication records for every domain we host. They prove to other providers that your mail really comes from you, and make it harder for anyone to send email pretending to be your business.
Spam and phishing filtering
Incoming mail is checked against well-known blocklists (including Spamhaus) and spam rules, and links are checked against lists of known phishing and malware sites. Likely spam is moved to your Junk folder, so you can still check it.
Backups
Every night we back up mailboxes, calendars, contacts and settings to Amazon S3 in London, separate from our mail servers. Backups are encrypted on our server before they leave it, and are protected from deletion for 30 days. We keep 30 daily and 12 monthly copies, and we test restoring from them every three months.
Abuse
How we handle abuse
ZTD Office is for everyday business email between people. We don’t allow bulk or marketing email, purchased mailing lists, phishing or malware. The full rules are in our Acceptable Use Policy.
- Every mailbox can send up to 500 messages a day, to at most 100 recipients each, as our Acceptable Use Policy sets out. The mail server enforces this, so a compromised account can’t send large volumes of mail, and we’re alerted as soon as a mailbox reaches its limit.
- Bounces and spam complaints are tracked for every domain we send from.
- If an account sends spam or looks compromised, we suspend it straight away, then work with the customer to secure it.
- Anyone can report abuse from a ZTD Office address to abuse@ztdoffice.com.
Privacy
Your email is your business
We don’t show adverts, and we don’t sell your email or use it for marketing. We only access a mailbox when we need to run the service, when you ask us to (for example, to look into a problem you’ve reported), or when the law requires it.
For your mailboxes, we act as a data processor on your behalf. Our Privacy Policy explains this and lists the other companies we use to run the service.
This website sets no cookies and uses no analytics or tracking. See the cookie notice.
Standards
Working towards ISO/IEC 27001
We’re working towards ISO/IEC 27001, the international standard for information security management. We are not certified yet. Changes to our systems already go through a documented review and approval process.
Reporting a security issue
If you think you’ve found a security problem in ZTD Office, please email security@ztdoffice.com. Tell us what you found and how to reproduce it. Please don’t access other people’s data or disrupt the service while testing.
Our security contact details are also published at /.well-known/security.txt.
Questions about security?
If you need more detail for your own records or a client’s questionnaire, ask us.