Security Policy
Effective Date: January 1, 2026 · Last Updated: August 19, 2026
1. Scope
This Policy applies to Inictus services and infrastructure, including Inictus Workspace, Business Mail, SMTP Relay, Email Marketing, Calendar, Chat, Meet, Todo, Docs, Drive, Contacts, CRM, Projects, Workflow, Notifications, APIs, Integrations, Billing, Identity, Administration, Master Panel, Security systems, Audit systems, Email infrastructure, and supporting databases.
2. Security Principles
Inictus follows security principles based on Confidentiality, Integrity, Availability, Least privilege, Defense in depth, Secure authentication, Continuous monitoring, Auditability, Data minimization, and Controlled access.
3. Identity & Access Management
Inictus uses centralized identity and access controls to manage access to the platform, including Authentication, Role-Based Access Control (RBAC), Permission policies, Session management, Multi-factor authentication where supported, Account recovery controls, Device/session management, Access logging, and Administrative authorization.
4. Role-Based Access Control (RBAC)
Inictus administrative environments use role-based access controls for User management, Billing, Subscription administration, Domain configuration, Security configuration, Feature access, File access, Organization administration, Audit access, and API administration.
5. Staff Management
Organization administrators may provision and manage staff accounts through User provisioning, User suspension, Permission assignment, Role management, Session termination, Device/session monitoring, and Access revocation.
6. Password Security
Inictus applies password-security requirements appropriate to the service, enforcing minimum password lengths, mixed character types, mandatory password changes after initial onboarding, password reset verification, and protection against brute-force authentication attempts. Passwords are stored using salted cryptographic hashes.
7. Multi-Factor Authentication (MFA)
Inictus provides MFA mechanisms to strengthen account security. Customers are strongly encouraged to enable MFA for Administrators, Billing users, Security administrators, Users with access to sensitive information, and API administrators.
8. Session Security
Controls include Session expiration, Token expiration, Refresh-token controls, Session revocation, Device/session visibility, Logout, and Suspicious-session detection. Administrators can terminate active sessions in real time.
9. Encryption Standards
Inictus uses encryption technologies appropriate to protect information during transmission and at rest. This includes TLS 1.3/HTTPS for network communication, forced STARTTLS for SMTPS, cryptographic protection for authentication secrets, and AES-256 encryption at rest for supported storage systems.
10. Email Security & Anti-Spam
Implements multiple layers of email security including SPF validation, DKIM signing, DMARC validation, Spam detection, Phishing detection, Malware scanning, Malicious URL detection, Attachment analysis, Reputation controls, Rate limiting, Quarantine, and Abuse detection.
11. Domain Security & Verification
Custom domains must complete ownership verification before mail dispatch is activated. Inictus validates Domain ownership, DNS configuration, SPF, DKIM, DMARC, MX records, and Authentication alignment to prevent spoofing and unauthorized domain usage.
12. API Security
Inictus APIs use API keys, Access tokens, Service accounts, Scoped permissions, Rate limiting, Credential revocation, Credential rotation, Request validation, and Authentication logging.
13. API Rate Limiting
Rate limits are enforced to prevent abuse, credential attacks, API starvation, excessive resource consumption, and denial-of-service behavior.
14. Data Access Controls
Access to Customer Data is restricted according to User permissions, Organization roles, Application authorization, and Administrative policies. Personnel are not granted unrestricted access to Customer Data as standard operating practice.
15. Administrative Access
Privileged access to production systems is restricted to authorized personnel protected by strong authentication, role-based authorization, limited privileges, session controls, logging, and monitoring.
16. Audit Logs
Maintains read-only, tamper-evident audit records logging login events, authentication failures, user creation, user deletion, role changes, permission changes, domain verification, billing changes, subscription changes, API credential events, and security configuration changes.
17. Monitoring & Alerting
Continuous automated monitoring identifies abnormal traffic, authentication anomalies, excessive API activity, sending abuse, infrastructure failures, security events, performance degradation, and service errors.
18. Vulnerability Management
Identifies and remediates security vulnerabilities through regular software updates, dependency updates, security reviews, configuration reviews, vulnerability assessments, and priority incident remediation.
19. Secure Development Lifecycle
Incorporates peer code review, dependency scanning, access controls, environment separation, secure configuration, input validation, authentication testing, and authorization testing into deployment pipelines.
20. Infrastructure Security
Infrastructure employs network controls, firewall policies, service isolation, access restrictions, continuous monitoring, secure configuration, backup systems, and redundancy.
21. Database Security
Databases are protected using authentication, authorization, restricted network access, encryption at rest, automated backups, monitoring, and administrative access controls.
22. File & Object Storage Security
Inictus Drive and object storage use access authorization, signed access URLs, permission checks, tenant storage isolation, encryption, and audit logging.
23. Backup & Disaster Recovery
Automated backups support disaster recovery, infrastructure resilience, service continuity, data integrity, and security incident recovery.
24. Incident Response Plan (SIRP)
Formal 8-step incident response process: Detection, Initial assessment, Containment, Investigation, Remediation, Recovery, Post-incident review, and Customer/regulatory notification.
25. Security Incident Notification
Inictus notifies affected customer administrators within 72 hours of a confirmed security incident affecting Customer Data, detailing nature, affected systems, impact, remediation, and recommended actions.
26. Employee & Contractor Security
Personnel undergo security training, background checks where permitted, strict confidentiality obligations, credential management requirements, and immediate access revocation upon role change or departure.
27. Security Awareness
Ongoing internal training regarding account security, credential protection, phishing prevention, social engineering, data protection, and incident reporting.
28. Shared Security Responsibilities
Security is a shared responsibility. Customers must use strong passwords, enable MFA, restrict admin privileges, protect API keys, secure SMTP credentials, configure SPF/DKIM/DMARC, review active sessions, remove inactive users, and keep devices secure.
29. Security Reporting & Responsible Disclosure
Vulnerabilities should be reported directly to security@inictus.com with detailed steps to reproduce without accessing or modifying other customer data.
30. Responsible Disclosure Guidelines
Researchers must avoid accessing unnecessary customer data, disrupting services, destructive testing, or social engineering personnel.
31. Third-Party Security Audits
Third-party cloud hosting providers (AWS, Hetzner, Cloudflare) maintain independent SOC 2 Type II, ISO 27001, and PCI-DSS compliance certifications.
32. Security & Customer Data Ownership
Customer Data remains owned by the Customer. Inictus processes Customer Data solely to provide and secure the Services and does not acquire ownership merely through processing.
33. Security Limitations & Risk Acknowledgement
While Inictus continuously works to eliminate security risks, internet-based services carry inherent risks from third-party networks, user devices, compromised credentials, zero-day threats, or social engineering.
34. Policy Updates
This Security Policy is updated regularly as infrastructure and services evolve. Revisions are published on the website with an updated date.
35. Security Contact Information
Navkar Infotech Services · Product: Inictus · Security Team: security@inictus.com · Support: support@inictus.com · Website: https://inictus.com
Ready to transform your business communication?
Start your 3-month trial for just $1. Every account includes 2 complimentary business email mailboxes, custom domain setup, and dedicated customer support.