Is Stannp.com secure for uploading and sending data?

Every mailing list you upload is a list of real people. Names, addresses, sometimes account numbers or appointment dates. So before you hand that list to any direct mail provider, it's fair to ask whether it's safe.

Yes, Stannp.com is secure for uploading and sending data. The platform is independently certified to ISO 27001:2022, and encrypts your data with 256-bit AES at rest and TLS 1.2/1.3 in transit. UK customer data stays within the EEA, on Microsoft Azure's Ireland data centres, and the platform is scanned continuously and tested regularly by independent security firms.

October is Cybersecurity Awareness Month, which makes it a good moment to look at this properly. According to the UK Government's Cyber Security Breaches Survey 2025/2026, 43% of UK businesses experienced a cyber security breach or attack in the last 12 months. Your mail provider is part of your security, whether you've checked them or not.

Below, we answer the questions you should ask any direct mail provider about security, and how Stannp.com answers each one.

Key takeaways.

• Stannp.com is certified to ISO 27001:2022, ISO 9001:2015, Cyber Essentials and PCI DSS 4.0.1, and is registered with the ICO.
• Your data is encrypted with 256-bit AES at rest and TLS 1.2/1.3 in transit, with connections rated A+ by Qualys SSL Labs.
• UK customer data is stored only in the EEA, on Microsoft Azure's Ireland data centres.
• Each customer's data is kept separate from every other customer's, and access is controlled by role.
• Only 15% of UK businesses review the cyber risks posed by their immediate suppliers, so asking your mail provider these questions puts you ahead.

Why does data security matter in direct mail?

Direct mail runs on personal data. A mailing list is names and addresses at the very least, and transactional mail like statements, invoices and reminders often carries far more. Under UK GDPR, you're still responsible for that data when a supplier processes it for you.

Most businesses don't check. The Cyber Security Breaches Survey 2025/2026 found that only 15% of UK businesses review the cyber security risks posed by their immediate suppliers, and only 22% consider cyber security to a large extent when buying software.

The same survey found that 14% of businesses hold personal data that isn't protected by encryption or anonymisation. If your mail provider is one of them, your customers' details are exposed through no fault of your own.

So the questions below aren't box ticking. They're the checks that keep your customers' data, and your reputation, where they should be.

Is your direct mail provider independently certified?

This is the first question to ask, because a certificate means someone outside the business has checked. Stannp.com holds five security, quality and environmental certifications plus ICO registration, all with certificates you can download from our accreditations and certifications page.

Cyber Essentials is worth a closer look. According to the Cyber Security Breaches Survey 2025/2026, only 5% of UK businesses hold it. If a provider can't show you a current certificate, ask why not.

How is your data encrypted on Stannp.com?

Your data is encrypted from the moment you upload it. Stannp.com uses 256-bit AES encryption for data at rest and TLS 1.2/1.3 for data in transit, and consistently achieves A+ ratings from Qualys SSL Labs.

In plain terms, that covers two moments:

• In transit: when you upload a CSV, send a PDF or call the API, the connection is encrypted so nobody can read it on the way.
• At rest: once your data is stored, it's encrypted on the server, so it can't be read even if storage were accessed directly.

The keys that unlock that encryption are managed through Azure Key Vault with strict access controls. Full detail is in our platform and infrastructure security section of the trust centre.

When you ask another provider this question, listen for specifics. "Your data is safe with us" tells you nothing. An encryption standard and a protocol version tell you something.

Where is your data stored?

UK customer data is stored exclusively within the European Economic Area (EEA), on Microsoft Azure's Ireland data centres. Stannp.com doesn't transfer UK customer data outside the EEA, and backups are kept in geographically separate server regions that are also inside the EEA.

This matters for UK GDPR. Stannp.com acts as a data processor on your behalf, under UK GDPR and the Data Protection Act 2018, and you keep full control of your data, including the ability to delete it at any time.

It's worth asking any provider two follow-up questions here. Do they act as a processor, or do they claim any rights over your data? And can you delete your data yourself, or do you have to ask? Our policies, including the Data Processing Agreement, are in the trust centre.

Who can access your data on Stannp.com?

Only the people who need to. Stannp.com uses role-based access control with least privilege principles, which means staff can only reach the systems their role requires. Multi-factor authentication is mandatory on all internal systems, every user has a unique account, and there are no shared credentials.

Every access is logged, monitored and regularly audited. Audit logs are kept for 12 months and protected against changes, and a security information and event management (SIEM) system watches activity 24/7 with real-time alerts.

Your data is also kept apart from everyone else's. The platform uses a multi-tenancy architecture, so each customer's data is completely segregated from other customers.

On your side, you control who in your team gets in. Paid plans from Growth upwards include multiple user logins, so each person can have their own account rather than sharing one. That makes it easy to remove access the day someone leaves. See detailed pricing for what each plan includes.

How often is the Stannp.com platform tested?

All the time. Stannp.com runs continuous automated vulnerability scanning across its infrastructure, monthly vulnerability scans, and regular penetration testing by independent, specialist security firms. Testing covers the OWASP Top 10 (the most common web application risks) as a minimum.

Finding problems is only half of it. The other half is how fast they're fixed. Stannp.com works to clear timeframes:

For comparison, the Cyber Security Breaches Survey 2025/2026 found that only 13% of UK businesses carried out penetration testing in the last 12 months.

A good provider should be able to tell you how they test, who tests them and how quickly they fix what's found. If they can't give you numbers, that's an answer in itself.

What happens if something goes wrong?

Stannp.com is built to recover quickly. Business critical data is backed up automatically every 15 minutes, with daily full backups and weekly secondary backups stored in separate EEA server regions. Backups are encrypted, and recovery procedures are documented and tested every year.

The platform also runs 24/7 infrastructure monitoring with real-time alerts, and a 99%+ uptime SLA supported by redundant systems. You can check live platform status any time on the service status monitor.

If you have a security question or need to report a concern, the compliance team is on hand through the trust centre.

This is where a lot of businesses fall short themselves. Only 25% of UK businesses have a formal incident response plan, according to the Cyber Security Breaches Survey 2025/2026. It's reasonable to expect your suppliers to have one, and to have a plan of your own for when a supplier has a bad day.

How secure is the Stannp.com API?

The API carries the same protection as the rest of the platform. It uses token-based authentication, HTTPS/TLS encryption rated A+, and intelligent rate limiting. All API activity is logged and monitored through the SIEM system, and monthly vulnerability scans test specifically for the OWASP Top 10.

This matters most if you send mail automatically. Many businesses connect their CRM or billing system to the direct mail API so a letter or postcard goes out when something happens, like an invoice being raised or a customer going quiet. Transactional mail sent through virtual printing often carries the most sensitive data of all, from account numbers to balances owed. If you're weighing up both kinds of mail, our guide to marketing mail or transactional mail explains the difference.

Using the API needs a live API key, which comes with a paid plan. Treat that key like a password: it's what proves a request really comes from you.

How can you keep your own mailing data safe?

A secure platform does a lot, but some of the protection sits with you. Phishing was by far the most common type of attack in the Cyber Security Breaches Survey 2025/2026, experienced by 38% of UK businesses. A stolen password gets around good encryption very easily.

Five habits that make a real difference:

1. Give everyone their own login. Shared accounts make it impossible to see who did what, or to cut off one person's access.

2. Turn on two-factor authentication. It stops a stolen password from being enough on its own, and you can switch it on for your own Stannp.com login in your account settings. Only 47% of UK businesses use it, according to the same survey.

3. Keep API keys out of shared places. Never paste them into emails, chat threads or code that other people can see. If one leaks, replace it straight away.

4. Only upload what you need. If a campaign only needs a name and address, leave the rest of the spreadsheet behind.

5. Tidy up old data. Delete lists and campaigns you no longer need. Data that isn't there can't be lost.

None of these take long, and they turn a secure platform into a secure process.

Send your next campaign with confidence.

Everything in this guide is published in full, with downloadable certificates and policy documents, in the Stannp.com trust centre. If your procurement or compliance team needs it, it's all there.

Ready to see the platform for yourself? Create your free account, with no minimum order, or log in and get your next campaign out the door knowing your data is in safe hands.

Frequently asked questions.

Is Stannp.com GDPR compliant?

Yes. Stannp.com processes personal data as a data processor on behalf of its business customers, in line with UK GDPR and the Data Protection Act 2018. It's also registered with the Information Commissioner's Office (ICO).

Is Stannp.com ISO 27001 certified?

Yes. Stannp.com is independently certified to ISO 27001:2022 for information security management, with annual audits. You can download the certificate from the trust centre.

Where does Stannp.com store UK customer data?

UK customer data is stored exclusively within the EEA, on Microsoft Azure's Ireland data centres. It isn't transferred outside the EEA, and backups are kept in separate EEA server regions.

Is it safe to upload a mailing list to an online direct mail platform?

It is when the platform encrypts your data, controls access tightly and is independently certified. Check for encryption at rest and in transit, ISO 27001 or Cyber Essentials, and clear data storage locations before you upload anything.

Can I delete my data from Stannp.com?

Yes. You keep full control of your data and can delete it at any time. Stannp.com also supports all UK GDPR data subject rights.

Are card payments on Stannp.com secure?

Yes. Stannp.com is compliant with PCI DSS version 4.0.1, the security standard for handling payment card data, with annual validation and quarterly vulnerability scanning.

How do I report a security concern to Stannp.com?

Contact the compliance team through the form in the Stannp.com trust centre. It handles security questions, privacy enquiries and reports of security issues.

Good security shouldn't be something you have to take on trust. Create your free account and see how Stannp.com handles your data from the very first upload.