Independent assurance

Mailtrap supports security and vendor review with independent audits, certifications, and security documentation.

SOC 2 Type II

SOC 2 Type II evaluates the design and operating effectiveness of Mailtrap’s controls under the AICPA Trust Services Criteria.

Request SOC 2 report
ISO 27001:2022

ISO 27001:2022 certifies Mailtrap’s information security management system against internationally recognized security requirements.

Request ISO certificate
SOC 3

SOC 3 provides a publicly available report on Mailtrap’s controls under the AICPA Trust Services Criteria.

Download SOC 3 report
Penetration testing

Independent penetration testing evaluates Mailtrap’s application and infrastructure for exploitable security weaknesses.

Download pen test certificate Request full pen test report

Control monitoring

Mailtrap continuously monitors controls across application, data, infrastructure, network, organizational, and product security.

App Security

  • App Security Code review process
  • App Security Software development lifecycle
  • App Security Vulnerability management
  • App Security Web application firewall

Data Security

  • Data Security Daily database backups
  • Data Security Encryption at rest
  • Data Security SSL/TLS enforced
  • Data Security System access control policy

Product Security

  • Product Security Hard-disk encryption
  • Product Security MFA on accounts
  • Product Security Session lock
  • Product Security Terms of service

Network Security

  • Network Security Denial of public SSH
  • Network Security Firewalls
  • Network Security Malware detection software
  • Network Security Unique accounts used

Organization Security

  • Organization Security Acceptable use policy
  • Organization Security Disaster recovery plan
  • Organization Security Incident response plan
  • Organization Security Security training
  • Organization Security Code of conduct

Infrastructure Security

  • Infrastructure Security Cloud data storage restricted
  • Infrastructure Security Security patches automatically applied

Security features

Mailtrap provides account-level security features to help teams manage access, authentication, and activity visibility.

API key permissions

API key permissions

Define what each key can do and see what emails they sent in Email Logs.

Two-factor authentication (2FA)

Two-factor authentication (2FA)

Add an extra layer of account protection with two-factor authentication.

SSO

SSO

Let eligible teams sign in through their organization’s identity provider.

Audit logs

Audit logs

See who changed what (permissions, domains, inboxes, webhooks) and stream audit events to your own systems via webhook.

Privacy and data protection

Mailtrap documents how customer data is processed, protected, stored, and shared through its privacy, DPA, GDPR, data residency, subprocessor, and DORA resources.

Data residency

Customer data is hosted in US data centers. EU data residency is in development.

Learn more
Data Processing Agreement

Mailtrap’s DPA is incorporated into the Terms of Service and applies when Mailtrap processes protected customer data as a processor on your behalf. You can get a signed copy online.

Read the DPA Sign the DPA Read the DORA addendum
GDPR and international transfers

Mailtrap participates in the EU–U.S. Data Privacy Framework, its UK Extension, and the Swiss–U.S. DPF. The DPA also provides for EU Standard Contractual Clauses and the UK Addendum, when applicable.

Subprocessors

Mailtrap uses third-party subprocessors to provide its services. The current list includes each provider’s purpose and location.

View subprocessors

Need something not available in the Trust Center?

Request custom vendor and security questionnaires, additional documentation, reports, or certifications from the Mailtrap security team.

Contact us about custom security requests
Question icon

Questions security reviewers ask

  • Does Mailtrap have a SOC 2 Type II report?

    Yes. Request the report in the Trust Center →

  • Is Mailtrap ISO 27001:2022 certified?

    Yes. Request the certificate in the Trust Center →

  • Does Mailtrap perform penetration testing?

    Yes. You can download the completion certificate and request the full report through the Trust Center.

  • Where can I request Mailtrap’s security reports?

    In the Trust Center. The SOC 2 Type II report, ISO 27001:2022 certificate, and penetration test report are shared after approval. The SOC 3 report and penetration test certificate can be downloaded directly.

  • Where is Mailtrap customer data hosted?

    In US data centers. EU data residency is in development.

  • How does Mailtrap support GDPR requirements?

    Through the Data Processing Agreement, Standard Contractual Clauses for international transfers, and a published subprocessor list.

  • Can I sign a DPA with Mailtrap?

    Yes. The DPA applies when Mailtrap processes protected customer data as a processor on your behalf, and it is incorporated into our Terms of Service. You can get a signed copy online.

  • Which subprocessors does Mailtrap use?

    The current list, with each provider’s purpose and location, is in our Privacy Policy.

  • Does Mailtrap continuously monitor its security controls?

    Yes. Control status updates live in the Trust Center.

  • What security policies does Mailtrap maintain?

    Information Security, Password, Risk Assessment, Data Retention, Data Classification, and Vendor Management policies, plus a Code of Conduct. Request them in the Trust Center →

  • Can Mailtrap complete our security questionnaire?

    Yes. Contact us to request a security questionnaire or security review.