Security and compliance
How Gondero is designed to protect your data and your sending, with an honest status for each control. Nothing here is live until the product is.
How customer data is kept apart
All customers share one database, but every customer table uses row-level security: the database itself refuses to return another customer’s rows. Without a customer context it returns no rows at all.
Stored credentials are encrypted with keys kept for each customer. Our administrators do not read your content, except in a support session you allow, which is time-limited and logged.
Signing in
Two-factor sign-in is designed to be required: a passkey or an authenticator app, plus recovery codes. There are no SMS codes.
Session limits are still being set.
Sending safely
Gondero sends only from your own mailbox. Each mailbox has a daily cap and a gradual start, and Gondero pauses it on its own when bounce or complaint rates pass a set limit.
Every email carries an unsubscribe link and the one-click header. The suppression list keeps working even when an account is suspended. Open tracking is off by default.
Controls ledger
| Control | What it means | Status |
|---|---|---|
| Row-level security | The database refuses another customer’s rows; no customer context means no rows. | In development |
| Per-customer encryption keys | Stored credentials are encrypted with a key kept for each customer. | In development |
| Time-limited support access | Administrators see your content only in a session you allow, logged and time-limited. | In development |
| Two-factor sign-in | Passkey or authenticator app, plus recovery codes. No SMS codes. | In development |
| Own mailbox only | Email leaves from the mailbox you connect; there is no shared sending domain. | In development |
| Daily caps and gradual start | A cap per mailbox, new volume rising step by step. | In development |
| Automatic pause | A mailbox is paused when bounce or complaint rates pass a set limit. | In development |
| One-click unsubscribe | Unsubscribe link plus the one-click header; suppression keeps working. | In development |
| Open tracking off by default | No tracking pixel unless you turn it on. | In development |
| Country rule check | Strictest rule when unclear; İYS check before a Türkiye send; rules are drafts. | In development |
| SOC 2 / ISO 27001 | We hold neither certification. | Not yet |
| Public status page | There is no status page yet. | Planned |
Country rules
Gondero holds rules per country and recipient type. When the country or the recipient type is unclear, the strictest rule applies and the email is stopped.
For Türkiye, Gondero asks for the address’s İYS registration and checks for refusals before sending. Registering addresses stays the customer’s duty.
Every rule row is a draft until a lawyer approves it. Gondero describes what the product does; it does not tell you what the law requires of you.
Where data lives
We will publish the hosting region before launch.
Certifications
We do not hold SOC 2 or ISO 27001 certification. This page will say so when that changes.
Sub-processors and DPA
The sub-processor list and a data processing agreement are being prepared as drafts and will be published before launch.
Report a vulnerability
Write to security@gondero.com. The same contact is in our security.txt file.
Status
A public status page is planned.