Version 2.0 of 13/10/2026 — Our commitment to the confidentiality and security of your data.
This policy defines the security requirements applicable to all SaaS Email and SMS delivery services operated by Oxemis. Its goal is to guarantee the highest level of trust for our customers by protecting the data we process against any unauthorised disclosure, alteration or service interruption.
1. Introduction
Founded in 2004, Oxemis has been built on a culture of longevity and control. In a constantly changing technology sector, our company has always favoured a security approach based on caution, risk analysis and real-world effectiveness, rather than giving in to IT fads or unnecessary complexity.
This philosophy of “controlled technical restraint” allows us today to run an infrastructure in which we understand every component, limiting the attack surfaces often created by stacking unaudited third-party software layers.
Human Capital: The First Pillar of Security
Oxemis’s security does not rely on algorithms alone, but on an exceptionally stable team. Most of our staff have been with the company since it was founded. This loyalty and historical knowledge of the information system provide a unique safeguard against configuration errors and insider risks.
At Oxemis, security is a culture shared by experts who designed the system and evolve it with a long-term vision, ensuring a consistency that high-turnover organisations cannot offer.
Related Documents
This ISSP (Information Systems Security Policy) is the technical and organisational foundation of our defence strategy. It should be read together with the following contractual documents:
- The DPA (Data Processing Agreement): which defines our legal and operational responsibilities as a processor.
- The Personal Data Protection Charter (Privacy Policy): which specifies the nature of the processing and the rights of data subjects under the GDPR.
Together, these documents form our inseparable compliance framework for protecting our customers’ assets.
Policy Objectives
This document aims to formalise the operating rules that allow us to maintain our three key indicators:
- Confidentiality: strict protection of contact lists and content in transit.
- Integrity: accuracy of deliverability reports and technical logs.
- Availability: an operational delivery service backed by a resilient, proven infrastructure.
2. Logical Security and Architecture
Oxemis’s architecture is based on a strategy of segregation and sovereignty.
Infrastructure Control
Sovereign Hosting: Oxemis does not use public cloud providers (hyperscalers) to store sensitive data. The infrastructure consists exclusively of dedicated servers (OVHcloud, Scaleway) physically located in France and the European Union.
Multi-tenant Isolation: data separation between customers is ensured by a unique identifier (Tenant ID) injected into every application request. No cross-account access is technically possible without valid authentication for the account concerned.
Encryption and Data Flows
Internal and External Flows: encryption is the rule for all data in transit. TLS 1.2+ and HTTPS are mandatory. Any unsecured connection is systematically rejected.
Message Content: following the “Privacy by Design” principle, Oxemis does not store the bodies of messages sent via SMTP and the API after processing. Once delivery is complete, the data is purged.
3. Identity and Access Management
Access control is based on the principle of least privilege: access is granted only when required for the task.
3.1. Administrator Access (Internal Team)
Strong Authentication: access to administration interfaces and servers is only possible using secure digital keys (SSH/certificates). Simple passwords are prohibited for administration.
Traceability: every action performed by an administrator on production is recorded in audit logs.
3.2. Customer Access
Web Customer Area: customer accounts are secured by a strong password policy combined with Multi-Factor Authentication (MFA).
API Usage: programmatic access is secured by unique API keys. Rotating these keys is the customer’s responsibility, and they can be revoked instantly through the Oxemis interface.
4. Resilience and Operational Maintenance
Resilience is at the heart of our business as an email/SMS service provider, to guarantee deliverability.
4.1. Business Continuity (BCP) and Disaster Recovery (DRP)
Geo-distributed Redundancy: services are spread across several remote data centres. If one site fails, the switchover to a backup site is documented and tested.
Restore Tests: backup validity is verified by restore tests carried out at least once a year.
4.2. Maintenance and Updates
Patch Management: servers are configured to automatically apply critical security updates. For major updates, a prior testing cycle in a staging environment is mandatory.
5. Workstation and People Security
Workstations are treated as a secure extension of the information system.
5.1. Endpoint Protection
Full-Disk Encryption: BitLocker is mandatory on all technical team PCs. In case of loss or theft, data on the disk must remain unreadable.
No Storage of Customer Data: workstations must never be used to store extracts of customer databases. All data handling must be done through secure server-side tools.
5.2. Staff Management
Initial and Ongoing Training: every employee receives cyber-risk awareness training (phishing, social engineering, secrets management) from onboarding and throughout their career. This training is not merely theoretical: it draws on the company’s historical knowledge of threats encountered since 2004.
Active Technology Watch: the technical team dedicates part of its working time to monitoring vulnerabilities (CVEs) affecting our software components (Debian, Postfix, development environments). This alert culture enables immediate response and smooth information sharing within our technical unit.
Individual Accountability: every team member plays a role in information system security. The stability of our workforce allows good practices and “security reflexes” (locking sessions, no local storage…) to be passed on naturally; they have become standard behaviour in our offices.
Offboarding: an “account closure” procedure is triggered immediately when an employee leaves, revoking their access keys and changing any shared secrets.
6. Security Incident Management
Oxemis maintains a response procedure for incidents (security flaws or critical bugs).
Alert Reception: a single channel (support@oxemis.com) allows incidents to be reported 24/7.
Notification: in accordance with the GDPR, in the event of a personal data breach, Oxemis undertakes to notify its customers within a maximum of 48 hours after the incident has been qualified.
This English version is provided for convenience. In case of discrepancy, the French version prevails.