Information security & data privacy
Gaggle Mail is used by thousands of organisations, from book clubs to universities. Here is how we secure and protect your information.
SOC 2
Gaggle Mail holds a SOC 2 Type 1 report, issued June 2026 by an independent auditor, and our security controls are continuously monitored. If your organisation needs a copy of the report for a procurement or security review, email us and we will send it under a confidentiality agreement.
Encryption
All data served by Gaggle Mail is transferred over encrypted HTTPS. Email delivery uses TLS wherever the receiving mail server supports it. Data at rest is encrypted using our cloud providers' managed encryption.
To access group data stored on Gaggle Mail, users must be logged in with their own account, where we enforce industry-standard authentication and password requirements (all passwords are salted and hashed).
No data sent over a Gaggle Mail group is accessible to the public internet.
Infrastructure
Gaggle Mail is 100% cloud-based. We run on Google Cloud Platform (GCP) and Amazon Web Services (AWS), using data centres based in the US. Both providers maintain SOC 2, ISO 27001 and equivalent certifications.
Access control
Access to our production infrastructure is restricted to named staff on a least-privilege basis, with multi-factor authentication required on every administrative account.
Our support team does not have access to production infrastructure. Support agents work only within our help desk and the Gaggle Mail admin console, and see only what is needed to resolve your ticket.
Monitoring
Our external infrastructure is scanned nightly for vulnerabilities by an automated scanning service, and dependencies are monitored and patched. We run error and uptime monitoring with alerting, and every code change is tracked in version control and reviewed before deployment.
Data privacy
- Our Data Processing Agreement applies to every customer automatically. It sets out how we process your members' data, our security measures, and the full list of sub-processors we use.
- Our Terms of Service cover how we handle your own account and billing information.
- Our GDPR statement.