Security & compliance
Enterprise-grade security, independently audited
Every document is protected by the same security infrastructure trusted by Fortune 100 companies and regulated industries worldwide.
By the numbers
Security that speaks for itself
256-bit
AES encryption standard
SOC 2
Type II certified
100%
Chain-of-custody tracked
30+
Years compliance expertise
0
Data breaches on record
99.9%
Platform uptime SLA
Certifications & standards
Every certification regulated industries require
Digital Mailroom is independently audited and certified across the full spectrum of enterprise compliance requirements.
HIPAA certified
Full compliance with the Health Insurance Portability and Accountability Act. Business Associate Agreements available for healthcare clients on request.
SOC 2 Type II
Independently audited controls for security, availability, processing integrity, confidentiality, and privacy. Recertified annually by an independent CPA firm.
SSAE 18
Statement on Standards for Attestation Engagements No. 18 — the gold standard for service organisation reporting used by auditors worldwide.
GDPR compliant
Full compliance with the EU General Data Protection Regulation. Standard Contractual Clauses in place for all EEA data transfers. DPA available on request.
PCI-DSS ready
Payment processing handled through PCI-DSS Level 1 certified processors. No cardholder data is stored on our systems at any point.
CCPA compliant
Full compliance with the California Consumer Privacy Act. We do not sell personal data. California residents can exercise all CCPA rights on request.
Infrastructure security
Built secure from the ground up
Security is not a layer we added — it is the architecture every component is built on.
256-bit AES encryption
All data encrypted at rest and in transit using AES-256 and TLS 1.3 — the same standard used by US government agencies and major financial institutions.
Zero-trust architecture
Strict identity verification for every user, device, and system regardless of network location. MFA enforced on all accounts with no exceptions.
Complete audit trails
Every document access, scan, and action is logged with timestamp and user attribution. Full chain-of-custody from receipt to final delivery.
Annual penetration testing
Independent third-party security assessments every year. Critical vulnerabilities addressed within 24 hours; high severity within 7 days.
Role-based access controls
Granular permissions ensure each user sees only the documents they are authorised to access. Supports unlimited custom roles mapped to your org structure.
99.9% uptime SLA
Redundant infrastructure across multiple availability zones. Automated failover with real-time monitoring and a guaranteed uptime commitment in your contract.
How we protect your mail
A secure chain of custody at every step
From the moment your mail arrives at our facility to the moment it appears in your portal — every step is controlled, logged, and auditable.
Secure receipt
Mail arrives at our SOC 2 certified facility. Every item is barcode-logged on arrival and assigned a unique chain-of-custody identifier before any staff member handles it.
Controlled scanning
Documents are scanned in access-controlled rooms by background-checked, trained operatives. CCTV monitored. No personal devices permitted in scanning areas.
Encrypted upload
Scanned files are encrypted and transmitted to your secure portal over TLS 1.3. Zero plaintext transmission at any point in the process.
Retention & disposal
Physical mail held per your instructions, then shredded and certified-destroyed with a destruction certificate. Digital records retained per your data retention policy.
