Dedicated security team
We have a dedicated information security team, responsible for securing the application, identifying vulnerabilities and responding to security events.
Emma’s powerful digital marketing platform makes it easy for marketing teams of all sizes to create beautifully designed email campaigns that drive results. Identify who to target, automate your marketing programs and integrate with the technologies you use most to deliver more timely, personalized and effective communications. As part of our commitment to provide a world-class product we care about privacy and data security.
Our adaptive, forward-looking measures are our promise to you.
We have a dedicated information security team, responsible for securing the application, identifying vulnerabilities and responding to security events.
We store and process data in a US-based cloud environment which meet critical standards that fulfill requirements of a variety of compliance mandates, including SOC 2 Type II and ISO27001.
We have a security policy in place aligned with the ISO 27001 standard. Our security documentation is frequently reviewed and updated to reflect changes to our processes made in response to newly identified threats, as well as our commitment to continuous improvement.
We use the NIST Cyber Security Framework to measure our ability to identify, protect, detect, respond and recover from security events.
All staff and contractors go through a vetting process where they are subject to background checks and confidentiality agreements.
All employees receive security awareness and security training annually. Additional training is provided as needed based upon existing threats.
We implement physical controls designed to prevent unauthorized access to, or disclosure of, customer data.
We only use state of the art data centers and cloud providers. Our data centers are monitored 24×7 for all aspects of operational security and performance. They are also equipped with multi-stage security using proximity card access control system at ingress and egress doors, stringent access protocols and procedures with archived color CCTV monitoring and ingress biometric controls.
In addition, access is limited to authorized data center personnel; no one can enter the production area without prior clearance and an appropriate escort. Every data center employee undergoes background security checks.
Our cloud provider has the following certifications: PCI-DSS, ISO 27001, SOC 1 / 2 / 3, IRAP, ISO 27018 and ISO 9001.
More about the AWS compliance program can be found here.
Our application has been designed with focus on security by leveraging OWASP-aligned security principles for software engineering, encryption technologies and security assurance.
Our infrastructure is subject to security benchmarking and monitoring so that we maintain or exceed industry security standards. We also use a combination of regular scheduled scans of our application, as well as bug bounty programs, to ensure that every area of our application has undergone rigorous security testing.
Our scheduled vulnerability assessment scans simulate a malicious user, while maintaining integrity and security of the application’s data and its availability. We also leverage the services of an external third party to perform a yearly penetration testing exercise against our platform to make sure we’ve got every angle covered.
We protect our application using a number of advanced security controls including a Web Application Firewall (WAF). Our reputation is critical to our and clients’ success, and therefore, privacy is a cornerstone of our operations. The bottom line is that we’ll never use the information you entrust to us for purposes other than that information’s intended use. See our full privacy notice for more details.
We follow a continuous integration methodology for software engineering. Our development methodology and approach addresses security needs by undertaking code reviews as part of code release process. All releases are deployed to our staging environment for testing before being deployed to production.
We have separate environments and databases for different stages of the application development.
To protect data, we encrypt information at rest, including our backups, using AES 256. We maintain encryption for data in transit over the public internet by supporting TLS 1.2 or better, and also support opportunistic TLS for email sending.
We offer our customers the ability to protect their accounts using multi-factor authentication. We help further protect their data by storing their data within a unique identifier, which is used to retrieve data via the application or the API. Each request is authenticated and logged.
We put considerable effort into ensuring the integrity of sessions and authentication credentials. Passwords storage and verification are based on a one-way encryption method, meaning passwords are stored and validated using a strong salted hash.
The databases are further protected by access restrictions, and key information (including your password) is encrypted when stored. Data is either uploaded directly into the application using a web browser or uploaded via the API, which uses secure transfer protocols.
We use cookies for user authentication. We use session IDs to identify user connections. Those session IDs are contained in HTTPS-only cookies not available to JavaScript and/or tamper-proof.
All key actions on the application are centrally logged, audited and monitored. For instance whenever our staff access an account for maintenance or support functions, such activities are logged so we can refer to them later.
We consider vulnerability research conducted according to this policy to be:
You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
If you submit a report through our bug bounty program which affects a third party service, we will limit what we share with any affected third party. We may share non-identifying content from your report with an affected third party, but only after notifying you that we intend to do so and getting the third party’s written commitment that they will not pursue legal action against you or initiate contact with law enforcement based on your report.
Please note that we cannot authorize out-of-scope testing in the name of third parties, and such testing is beyond the scope of our policy. Refer to that third party’s bug bounty policy, if they have one, or contact the third party either directly or through a legal representative before initiating any testing on that third party’s systems or services. This is not, and should not be understood as, any agreement on our part to defend, indemnify, or otherwise protect you from any third party claim based on your actions.
That said, if legal action is initiated by a third party, including law enforcement, against you because of your participation in this bug bounty program, and you have complied with this Safe Harbor Policy and have not acted in bad faith, upon your written request, we will inform the third party that your actions were conducted in compliance with this Safe Harbor Policy.
If at any time you have concerns or are uncertain whether your security research is consistent with this Safe Harbor Policy, please submit a report in advance as set forth in the security text file located below.
Note that the Safe Harbor applies only to legal claims under our control; it does not bind independent third parties.
# Emma security contacts and policy
# Where this file should be found, if found somewhere else it’s not valid.
Canonical: https://myemma.com/.well-known/security.txt
# Our security contact channels
Contact: https://myemma.com/trust/report-a-vulnerability
Contact: mailto:[email protected]
# Link to our vulnerability disclosure policy
Policy: https://myemma.com/trust/security
# Languages that our team speaks and understands
Preferred-Languages: en-US
# When this information is considered stale.
Expires: 2024-06-20T05:00:00.000Z
See how Emma helps you create, optimize, and send email campaigns with confidence.