Are you SOC 2 or ISO 27001 compliant?
Why we invest in real security instead of compliance certificates.
No, ImprovMX is not SOC 2 or ISO 27001 certified — and that's a deliberate choice (for now).
Compliance certifications like SOC 2 and ISO 27001 are often treated as proof of security. In practice, they're expensive audits that verify you have processes documented, not that those processes actually keep you safe. Companies with these certifications still suffer breaches, and the certifiers themselves can be fraudulent.
What we do instead
Rather than spending money and effort on compliance paperwork, we invest directly in measures that actually protect your data:
- Annual penetration testing — independent security professionals thoroughly assess our infrastructure, APIs, and email pipeline every year.
- AI-driven security testing — continuous automated probing for new classes of vulnerabilities.
- Defense in depth — layered security across network, email validation (SPF/DKIM/DMARC), data handling, access control, and encryption.
- Round-trip monitoring — we verify email delivery to Gmail, Outlook, Yahoo, and iCloud around the clock.
- Postmortem transparency — when incidents occur, we publish honest postmortems on our blog.
For the full details on our approach, see our Security & Reliability page.