Most enterprises cannot say how many domains they own.
The inventory is the project. Brands acquired, campaigns registered, subsidiaries with their own DNS, and a long tail nobody has looked at since it was bought. This page is written for the person who has to evaluate us, not the person who wants a demo.
Pick the one that looks like your org chart.
The product is the same in all four. What differs is where the domains came from, who can change them, and which of them nobody has thought about in 3 years.
One company, many brands.
Each brand has its own marketing stack and its own idea of who owns DNS. Central security carries the risk but has no visibility.
Every domain has a named owner and an inherited policy. The parked ones are the exposure nobody had counted.
Every answer your vendor assessment needs, including the uncomfortable ones.
Filter by status. “Not yet” is one of the options because that is the first thing a reviewer wants to know, and making you read twenty rows to find it would be a choice, not an accident.
Two answers, and your questionnaire should record both. Infrastructure: the platform runs on PlatOps Security infrastructure, which holds a current SOC 2 Type II, and that report is shared under NDA today. DDMARC product: our own audit is in progress, and we will not claim the product is certified before it is. If your process requires a report naming DDMARC, log it as a gap now.
Same shape as SOC 2. Infrastructure: inherited from PlatOps Security’s ISO 27001 certified controls, with the certificate and statement of applicability available under NDA. DDMARC product: certification is underway and not yet held.
Alignment, not a certification — there is no such thing as GDPR certification. Data minimization and automatic retention limits are built in, not configured, and EU residency is selectable at provisioning. The DPA itself is in preparation: /dpa sets out the terms we work to, but there is no executed template to sign yet. Ask for timing before you build it into a procurement schedule.
A Business Associate Agreement is in preparation and cannot be signed today. DMARC report data does not normally contain PHI, but forensic samples can include message headers — which is the path a BAA would need to cover, and the reason to ask us for timing instead of assuming it is in place. A HIPAA-eligible (US) environment, isolated and run on HIPAA-eligible AWS services, is provisioned on request.
Aligned, with the same subject-access and deletion mechanisms used for GDPR requests.
Not authorized, and no authorization in flight. The underlying infrastructure controls are aligned, but if your procurement requires FedRAMP today we are not the right answer and would rather tell you now. Hosting in AWS GovCloud (US) is available on request — that is where the environment runs, not an authorization.
AES-256-GCM at rest, TLS 1.3 in transit, with keys held in AWS KMS hardware security modules (FIPS 140-validated). Per-organization encryption keys, so a key compromise cannot cross tenants.
Isolation is enforced at the storage layer, not by a filter in application code. Enterprise tenants can be provisioned on dedicated database instances.
US or EU, chosen when your tenant is created and fixed thereafter. Report data, forensic samples and audit logs all stay in that region. Tokyo, HIPAA-eligible (US) and AWS GovCloud (US) are provisioned on request with an Enterprise agreement, not self-serve.
Retention is configurable on Enterprise, with a hard purge that removes report and forensic data instead of flagging it deleted.
Published and versioned at /dpa#subprocessors, with 30 days' notice before we add or replace one. See the current, dated list there.
Continuous automated scanning, periodic third-party penetration testing. Summary letters are shareable under NDA; full reports are not distributed.
SAML 2.0 and OIDC single sign-on is provisioned on Enterprise agreements as part of the contract, not switched on from the dashboard. Self-serve plans sign in with an emailed link or code, a passkey, Google or a Microsoft work or school account; there are no passwords. Raise SSO before purchasing so it is written into the agreement from day one.
Not available. Users are not provisioned from an identity provider and roles are not synced from directory groups. Joiner-mover-leaver is handled through invitations and role changes in the dashboard, which works but is manual work at scale.
Not yet — organization-wide today. Three roles (admin, member, viewer) apply across the whole tenant; everyone in an organization sees every domain. Per-domain or per-brand scoping is not available yet. Separate organizations, or the partner model, give per-estate isolation in the meantime.
Every policy change, export and permission change, with actor, timestamp and source address, retained per the plan's retention schedule and exportable as CSV. It is not a long-term compliance archive on its own.
Per-service tokens with scoped permissions and independent rotation. Creation and revocation are logged; each key records its last use.
99.99% uptime is a term written into Enterprise agreements, with service credits defined in the agreement, not in a marketing page. Public uptime measurement is in preparation; until it exists, the status page's incident log is the record.
Two-hour target during business hours for Enterprise, with a named contact for onboarding and escalation.
Documented runbooks with defined severity levels. We notify affected customers without undue delay, and in any case within 72 hours of confirming a breach affecting your data.
Public status page with incident history retained, so you can see how we behaved, not how we describe ourselves.
Multi-AZ with automated failover. Recovery objectives and a DR test record are in preparation and will join the security packet.
Compliance evidence without the spreadsheet.
DDMARC scores every domain for DMARC compliance, A to F, from its policy and its authentication results, and lists what to fix first. From Professional, the same data downloads as a posture report covering the last 30, 90 or 365 days, which is the document an auditor or a board pack asks for.
A bulk-sender matrix checks every domain against the requirements Google, Yahoo and Microsoft publish, with a pass, fix-needed or manual-check status for each one. The scorecard and the report are also available over the API, so they can feed your GRC tooling instead of a quarterly export. How the score is calculated.
Nobody logs into another dashboard.
Findings go where your team already works, and provisioning happens from your own tooling. Read the identity column before you plan an SSO rollout.
Four weeks to reporting. Two quarters to reject.
Split into what we do and what only you can do, because the second column is where enterprise rollouts stall.
Inventory
Establish what you own before changing anything. This is usually where the surprises are.
Discovery sweep, posture report per domain, owner mapping workshop
Registrar access or a domain list, and someone who can name business owners
Tenant and access
Wire the platform into your workflow and decide who can change what.
Tenant and residency provisioning, role model, invitation flow
Sign-off on the role model and the list of people who need access
Monitoring live
Publish reporting records across the estate. Nothing is blocked and delivery is unaffected.
Record generation, publish verification, first sender inventory
DNS changes through your normal change process
Enforcement
Move brand by brand to quarantine and then reject, gated on pass rate, not on a date.
Staged rollout with safety gates, regression watch, evidence exports
Chasing the sending teams whose tools are not yet aligned
Where the data sits, and what the contract says.
Or have the work done for you.
Both are priced on the pricing page and scoped in writing before anything is billed.
A specialist owns your authentication, not a ticket queue.
From p=none to p=reject, done with you, not explained to you.
Dedicated onboarding — a named contact, tenant and residency provisioning, the role model — is part of an Enterprise agreement. If you want the rollout itself done for you on a fixed timeline, every sender aligned and the policy stepped to reject, that is the Enforcement sprint.
Start with the domain inventory.
Run the inventory on a 14-day Professional trial: 25 domains, card on file, nothing billed if you cancel. Most enterprises find domains they had forgotten in the first week. More than 25 domains? Ask for an Enterprise trial, or buy the outcome on one domain first: the Enforcement sprint is a $2,500 pilot with a written handover.
What buyers on this page ask.
Yes. Professional covers 25 domains and the Partner plan scales to 100+ (plus per-domain overage), all in one dashboard with role-based access control and an activity audit log. Larger footprints are handled on the Enterprise plan.
Yes, on Enterprise agreements: SAML 2.0 and OIDC single sign-on is provisioned as part of the contract. Self-serve plans sign in with an emailed link or code, a passkey, Google or a Microsoft work or school account (there are no passwords), with API access and webhooks from Protect, team roles from Growth and the activity log on every plan. If SSO is a requirement, raise it before purchasing so it is written into the agreement.
Data is encrypted at rest (AES-256-GCM) and in transit (TLS 1.3), with multi-tenant isolation. Infrastructure runs on PlatOps Security's SOC 2 Type II + ISO 27001-certified controls; DDMARC product certification is in progress. US and EU data residency options are available.
Yes. A policy impact simulator, readable aggregate-report insight, and ARC chain monitoring let you progress from p=none to quarantine and reject without disrupting legitimate mail across a large sender footprint.
Other solutions, comparisons and pricing. The product is the same on all of them — what changes is who has to approve it.