Information security

At Sendr, we are committed to safeguarding our customers' data and meeting recognised data protection and security standards. Sendr undergoes independent third-party audits to review and certify our security, data privacy and compliance controls, so that we can meet our customers' legal and organisational requirements for data security in line with international standards. 

Please contact us at security@sendr.ai if you'd like to speak with our team about our security practices. 

Security and information protection at the core 

This page sets out how we keep your data secure and how we comply with data protection law. 

1. ISO 27001 

ISO/IEC 27001 sets out the requirements for an information security management system (ISMS), including best practice for the security controls that help manage information risk. 

Sendr's ISMS is certified to ISO/IEC 27001:2022 by Citation ISO Certification Limited (certificate number 465452024), covering the supply of a software platform for GenAI marketing purposes. Our current certificate is valid until 6 October 2027, and you can verify it at www.IRQAO.com. We are audited regularly to maintain this certification. 

Being ISO 27001 certified means we continuously monitor, review and improve how we manage information security, including how we protect the business data our customers upload to Sendr, reduce risk and respond to security threats. 

2. Data protection 

Sendr complies with UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR. We act as a processor for the data our customers manage in Sendr, under the data protection terms in clause 8 of our Terms of Service. We act as a controller for the data described in our Privacy Policy. 

We give individuals clear information about their data rights, let them manage their preferences, and respond to requests to access or delete their data. Details are set out in our Privacy Policy. 

3. AI and your data 

We do not use the content of your messages, your contact lists or your prospects' data to train AI models. We use anonymised, aggregated campaign statistics, which do not identify any customer or individual, to improve recommendations, as described in clause 9 of our Terms of Service. 

4. Reporting an incident 

Customers who believe they have identified a security incident or vulnerability relating to the Sendr platform are encouraged to report it promptly to security@sendr.ai. Please include a description of the issue, relevant details to help us investigate and any supporting information available. Security reports will be reviewed and handled in accordance with our Security Incident Management Policy. 

5. Hosting and sub-processors 

Sendr's cloud hosting infrastructure is provided by a third-party provider that is SOC 2 compliant. We use carefully selected sub-processors to deliver our services, and we notify customers of changes as set out in our Terms of Service. A list of our sub-processors is available on request from security@sendr.ai.