Mailosaur Trust Center

generated: '2026-08-14'
method: searched
probe: true
source: https://trust.mailosaur.com and https://mailosaur.com/security
url: https://trust.mailosaur.com
secondary_url: https://mailosaur.com/security
platform: Vanta (EU tenant — app.eu.vanta.com)
certifications:
- ISO 27001:2022
- PCI DSS
- GDPR
- UK Data Protection Act
- CCPA
posture:
  hosting: Google Cloud Platform, data centres in the EU and the United Kingdom
  encryption_at_rest: AES-256
  audits: Regularly audited by independent third-party assessors
  questionnaires: >-
    Responds to Vendor Security Alliance (VSA) assessments and provides a
    Security Assessment Pack on request.
evidence:
- source: https://trust.mailosaur.com
  http_status: 200
  fetched: '2026-08-14'
  keywords:
  - trust center
  - vanta
  note: >-
    A real hosted trust centre, not a marketing page — served from
    trust.mailosaur.com on Vanta's EU tenant, with the document portal at
    app.eu.vanta.com. Found by subdomain probe; the earlier pass had recorded
    only the marketing /security page.
- source: https://mailosaur.com/security
  http_status: 200
  fetched: '2026-08-14'
  keywords:
  - iso 27001
  - pci dss
  - gdpr
  - ccpa
not_found:
- claim: SOC 2
  note: Not asserted on either surface.
- claim: HIPAA
  note: Not asserted on either surface.
- claim: FedRAMP
  note: Not asserted on either surface.
vulnerability_disclosure:
  found: false
  note: >-
    PROBED 2026-08-14 and not found — no /.well-known/security.txt (404), no
    /security.txt (404), no /responsible-disclosure,
    /security/responsible-disclosure or /vulnerability-disclosure page (all 404),
    no hackerone.com/mailosaur or bugcrowd.com/mailosaur programme (both 404),
    and no security@ address on the security, contact or privacy pages (which
    publish sales@, support@ and dpo@ only). No VulnerabilityDisclosure or
    Security pointer is emitted, because Mailosaur publishes no route for
    reporting a vulnerability.