Is Stannp.com secure for uploading and sending data?

Every mailing list you upload is a list of real people. Names, addresses, sometimes account numbers or appointment dates. So before you hand that list to any direct mail provider, it's fair to ask whether it's safe.

Yes, Stannp.com is secure for uploading and sending data. The platform is independently certified to ISO 27001:2022, and encrypts your data with 256-bit AES at rest and TLS 1.2/1.3 in transit. Canadian customer data is stored exclusively within Canada, on Microsoft Azure's Canadian data centres, and the platform is scanned continuously and tested regularly by independent security firms.

October is Cyber Security Awareness Month, which makes it a good moment to look at this properly. According to Statistics Canada, about 1 in 6 Canadian businesses (16%) were impacted by cyber security incidents in 2023, and spending on recovery from those incidents doubled to $1.2 billion. Your mail provider is part of your security, whether you've checked them or not.

Below, we answer the questions you should ask any direct mail provider about security, and how Stannp.com answers each one.

Key takeaways.

• Stannp.com is certified to ISO 27001:2022, ISO 9001:2015 and ISO 14001:2015, and is PCI DSS 4.0.1 compliant.
• Your data is encrypted with 256-bit AES at rest and TLS 1.2/1.3 in transit, with connections rated A+ by Qualys SSL Labs.
• Canadian customer data is stored exclusively within Canada, in Microsoft Azure's Canada Central and Canada East regions.
• Each customer's data is kept separate from every other customer's, and access is controlled by role.
• Only 26% of Canadian businesses had written cyber security policies in 2023, so checking how your suppliers handle security puts you ahead of most.

Why does data security matter in direct mail?

Direct mail runs on personal data. A mailing list is names and addresses at the very least, and transactional mail like statements, invoices and appointment reminders often carries far more. Under PIPEDA, your organization stays accountable for personal information it transfers to a third party for processing.

The cost of getting it wrong is rising. Statistics Canada found that while fewer businesses were hit in 2023 than in 2021, recovery spending doubled from about $600 million to $1.2 billion. Scams and fraud were the most common method behind those incidents, affecting half (50%) of impacted businesses, and identity theft rose 11 percentage points to 31%.

So the questions below aren't box checking. They're the checks that keep your customers' data, and your reputation, where they should be.

Is your direct mail provider independently certified?

This is the first question to ask, because a certificate means someone outside the business has checked. Stannp.com holds three independently audited ISO certifications and PCI DSS compliance, all listed on our accreditations and certifications page.

ISO 27001 is the one to look for first. It's the international standard for information security management, and an annual audit means the controls are checked every year, not just once. If a provider can't show you a current certificate, ask why not.

How is your data encrypted on Stannp.com?

Your data is encrypted from the moment you upload it. Stannp.com uses 256-bit AES encryption for data at rest and TLS 1.2/1.3 for data in transit, and consistently achieves A+ ratings from Qualys SSL Labs.

In plain terms, that covers two moments:

• In transit: when you upload a CSV, send a PDF or call the API, the connection is encrypted so nobody can read it on the way.
• At rest: once your data is stored, it's encrypted on the server, so it can't be read even if storage were accessed directly.

The keys that unlock that encryption are managed through Azure Key Vault with strict access controls. Full detail is in the platform and infrastructure security section of our trust centre.

When you ask another provider this question, listen for specifics. "Your data is safe with us" tells you nothing. An encryption standard and a protocol version tell you something.

Where is your data stored?

Canadian customer data is stored exclusively within Canada, in Microsoft Azure's Canada Central and Canada East regions. Backups are encrypted and kept in separate locations within Canada too, so your data stays on Canadian servers even when it's being protected.

This matters for Canadian privacy law. Stannp.com processes personal data as a service provider on behalf of its business clients, in compliance with PIPEDA and Canadian privacy laws, including Quebec's Law 25. You keep full control of your data, including the ability to delete it at any time, and Stannp.com supports PIPEDA data subject rights and Quebec Law 25 rights, including data portability.

It's worth asking any provider two follow-up questions here. Where exactly is your data stored? And can you delete it yourself, or do you have to ask? Our policies, including the Data Processing Agreement, are in the trust centre.

Who can access your data on Stannp.com?

Only the people who need to. Stannp.com uses role-based access control with least privilege principles, which means staff can only reach the systems their role requires. Multi-factor authentication is mandatory on all internal systems, every user has a unique account, and there are no shared credentials.

Every access is logged, monitored and regularly audited. Audit logs are kept for 12 months and protected against unauthorized changes, and a security information and event management (SIEM) system watches activity 24/7 with real-time alerts.

Your data is kept apart from everyone else's, too. The platform's multi-tenancy architecture keeps each customer's data completely segregated from other customers.

On your side, you control who in your team gets in. Paid plans from Growth upwards include multiple user logins, so each person can have their own account rather than sharing one. That makes it easy to remove access the day someone leaves. See detailed pricing for what each plan includes.

How often is the Stannp.com platform tested?

All the time. Stannp.com runs continuous automated vulnerability scanning across its infrastructure, monthly vulnerability scans, and regular penetration testing by independent, specialist security firms. Testing covers the OWASP Top 10 (the most common web application risks) as a minimum.

Finding problems is only half of it. The other half is how fast they're fixed. Stannp.com works to clear timeframes:

A good provider should be able to tell you how they test, who tests them and how quickly they fix what's found. If they can't give you numbers, that's an answer in itself.

What happens if something goes wrong?

Stannp.com is built to recover quickly. Business critical data is backed up automatically every 15 minutes, with daily full backups and weekly secondary backups. Backups are encrypted and kept for 30 days, with 12 months of total retention, and recovery procedures are documented and tested every year.

The platform also runs 24/7 infrastructure monitoring with real-time alerts, and a 99%+ uptime SLA supported by redundant systems across multiple server regions. You can check live platform status any time on the service status monitor.

If you have a security question or need to report a concern, the compliance team is on hand through the trust centre.

This is where a lot of businesses fall short themselves. Just over 1 in 4 Canadian businesses (26%) had written policies for cyber security in place in 2023, according to Statistics Canada. It's reasonable to expect your suppliers to have a plan, and to have a plan of your own for when a supplier has a bad day.

How secure is the Stannp.com API?

The API carries the same protection as the rest of the platform. It uses token-based authentication, HTTPS/TLS encryption rated A+, and intelligent rate limiting. All API activity is logged and monitored through the SIEM system, and monthly vulnerability scans test specifically for the OWASP Top 10.

This matters most if you send mail automatically. Many businesses connect their CRM or billing system to the direct mail API so a letter or postcard goes out when something happens, like an invoice being raised or a customer going quiet. Transactional mail sent through virtual printing often carries the most sensitive data of all, from account numbers to balances owed. If you're weighing up both kinds of mail, our guide to marketing mail or transactional mail explains the difference.

Using the API needs a live API key, which comes with a paid plan. Treat that key like a password: it's what proves a request really comes from you.

How can you keep your own mailing data safe?

A secure platform does a lot, but some of the protection sits with you. Scams and fraud were the most common method behind cyber security incidents at Canadian businesses in 2023, affecting half of those impacted, according to Statistics Canada. A stolen password gets around good encryption very easily.

Five habits that make a real difference:

1. Give everyone their own login. Shared accounts make it impossible to see who did what, or to cut off one person's access.

2. Turn on two-factor authentication. It stops a stolen password from being enough on its own, and you can turn it on for your Stannp.com account.

3. Keep API keys out of shared places. Never paste them into emails, chat threads or code that other people can see. If one leaks, replace it straight away.

4. Only upload what you need. If a campaign only needs a name and address, leave the rest of the spreadsheet behind.

5. Tidy up old data. Delete lists and campaigns you no longer need. Data that isn't there can't be lost.

None of these take long, and they turn a secure platform into a secure process.

Send your next campaign with confidence.

Everything in this guide is published in full, with certificates and policy documents, in the Stannp.com trust centre. If your procurement or compliance team needs it, it's all there.

Ready to see the platform for yourself? Create your free account, with no minimum order, or log in and get your next campaign out the door knowing your data is in safe hands.

Frequently asked questions.

Is Stannp.com PIPEDA compliant?

Yes. Stannp.com processes personal data as a service provider on behalf of its business clients, in compliance with PIPEDA and Canadian privacy laws, including Quebec's Law 25.

Where does Stannp.com store Canadian customer data?

Canadian customer data is stored exclusively within Canada, on Microsoft Azure's Canada Central and Canada East regions. Encrypted backups are kept in separate locations within Canada.

Is Stannp.com ISO 27001 certified?

Yes. Stannp.com is independently certified to ISO 27001:2022 for information security management, with annual audits. The certification is listed in the trust centre.

Is it safe to upload a mailing list to an online direct mail platform?

It is when the platform encrypts your data, controls access tightly and is independently certified. Check for encryption at rest and in transit, ISO 27001 certification, and where your data is stored before you upload anything.

Can I delete my data from Stannp.com?

Yes. You keep full control of your data and can delete it at any time. Stannp.com also supports PIPEDA data subject rights and Quebec Law 25 rights, including data portability.

Are card payments on Stannp.com secure?

Yes. Stannp.com is compliant with PCI DSS version 4.0.1, the security standard for handling payment card data, with annual validation and quarterly vulnerability scanning.

How do I report a security concern to Stannp.com?

Contact the compliance team through the form in the Stannp.com trust centre. It handles security questions, privacy enquiries and reports of security issues.

Good security shouldn't be something you have to take on trust. Create your free account and see how Stannp.com handles your data from the very first upload.