Confidence in every message and file
Send secure emails and share files with confidence. StayPrivateMail combines independently assessed security controls with a private customer experience: messages and files are easy to access, customers keep their own copies, and they can respond securely when needed.
Independently certified and assessed
StayPrivate operates an information security management system independently certified to ISO 27001 and holds Cyber Essentials Plus certification.
Security
Layered technical and organisational controls protect customer messages, files and information throughout their lifecycle.
Privacy
StayPrivateMail and Keepd are not built around advertising, profiling or exploiting personal information.
Customer copies
Customers receive their own copies of messages and files in Keepd, independent of the organisation that sent it.
Resilience
Our infrastructure and operational processes are designed to protect important information and keep it available.
Security by design
Secure customer communication needs protection when information is sent, accessed and retained. StayPrivateMail and Keepd use layered technical and operational controls across the service.
Encryption
Messages, files and sensitive information are encrypted in transit and at rest. Documents are also encrypted individually before storage, with controls governing access to their contents.
Access control
Access to systems and information is restricted according to operational need and limited to authorised personnel.
Secure infrastructure
StayPrivateMail and Keepd operate on professionally managed cloud infrastructure designed for security, resilience and scalability.
Environment separation
Production systems are separated from development environments, with access and configuration governed through our information-security processes.
Monitoring and maintenance
Systems and dependencies are monitored and maintained, with security vulnerabilities assessed and addressed according to risk.
Authentication
Customers access messages and files through authenticated Keepd accounts. Replies and uploads take place within the secure service.
Security controls independently assessed
ISO 27001
StayPrivate operates an information security management system certified to ISO 27001.
ISO 27001 provides a structured framework for identifying information-security risks, implementing appropriate controls and continually reviewing and improving those controls.
Cyber Essentials Plus
StayPrivate also holds Cyber Essentials Plus certification.
Cyber Essentials Plus adds independent technical verification to the Cyber Essentials framework, providing external assurance that important technical protections are operating effectively.
Additional security testing
We carry out additional internal security testing as part of the ongoing development and operation of StayPrivateMail and Keepd. This includes targeted testing when systems, features or potential vulnerabilities warrant further investigation.
G-Cloud supplier
StayPrivate services are available through the UK Government's G-Cloud framework, supporting procurement by public-sector organisations.
Built for regulated information
StayPrivate maintains security, privacy and contractual controls designed to support customers operating in regulated environments. Where a regulation applies directly to StayPrivate as a processor or service provider, we maintain the relevant arrangements. Where the obligation sits with our customer, StayPrivateMail is designed to help that customer meet its own communication, security and supplier-assurance requirements.
GDPR and processor obligations
StayPrivate operates in accordance with its applicable obligations under the UK GDPR and Data Protection Act 2018 and supports processing under the EU GDPR. Where StayPrivate processes personal data on behalf of a customer, appropriate processor agreements and sub-processor protections are maintained.
Our technical and organisational measures include individual document encryption, restricted access, permanent audit histories, data minimisation, controlled retention and deletion, business continuity and regular security assessment.
Support for HIPAA-regulated use
Where StayPrivate processes protected health information on behalf of a HIPAA Covered Entity or Business Associate, StayPrivate can operate as a Business Associate and enter into an appropriate Business Associate Agreement.
StayPrivate has assessed its controls against the administrative, physical and technical safeguards of the HIPAA Security Rule. Business Associate Agreements and supporting security information are available to qualifying healthcare customers as part of their due-diligence process.
Regulated customer communications
StayPrivateMail supports financial-services firms that need to send sensitive messages, share documents and receive information securely. Customers retain their own copies for future reference.
Clear access to messages and documents can support firms' customer communication processes. The regulated firm remains responsible for determining which rules apply to each communication, including any durable-medium requirements, and for its own regulatory compliance.
Our independent security assurance, auditability, controlled retention, business continuity and supplier-security documentation are also intended to support financial-services procurement and third-party risk reviews.
Customer-information safeguards
For US financial-services customers, StayPrivate's administrative, technical and physical security controls are designed to support supplier due diligence relating to protection of customer information, including requirements arising under the Gramm-Leach-Bliley Act and applicable Safeguards Rules.
For broker-dealers, investment advisers, investment companies, transfer agents and other institutions subject to SEC Regulation S-P, we can provide information about our safeguards, incident management, access controls, encryption, retention and sub-processor arrangements to support the firm's service-provider assessment.
CCPA / CPRA service-provider controls
StayPrivate supports organisations subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act.
Where StayPrivate processes personal information on a customer's behalf as a service provider or contractor, our contractual and operational controls restrict its use to the agreed business purposes and the operation of the service. StayPrivate does not sell customer personal information or share it for cross-context behavioural advertising.
Your customer’s copies belong with them
When your business sends a message or shares a file through StayPrivateMail, the customer receives their own copy in Keepd. Their messages and files are automatically organised and easy to return to, whether or not a reply is needed.
Customers can retain and access their copies independently of the organisation that originally sent them.
Your business remains responsible for its own records and systems. Keepd gives the customer their own account for the information they receive and want to keep.
Private to the individual
A Keepd account belongs to its user. Your business can access the communication and files exchanged with it through StayPrivateMail. That shared communication is separate from the customer's other private information.
Using StayPrivateMail does not give your business access to the rest of a customer's Keepd. One organisation cannot see messages or files shared by another organisation simply because both use StayPrivateMail.
Your information is used to provide the service
StayPrivateMail is not built around advertising, profiling or exploiting personal information. Information entrusted to StayPrivateMail and Keepd is used to provide and operate the services for which it was supplied.
We aim to collect and retain only the information needed to deliver those services, operate them securely and meet our legal obligations.
Available today. Accessible again later.
Customers may need a message or file long after it was first sent. StayPrivateMail and Keepd are designed to support everyday access as well as the ability to retain information for future reference.
Our systems incorporate backup, recovery and operational-resilience measures intended to protect against loss and maintain availability. We regularly review risks affecting the confidentiality, integrity and availability of information through our information security management system.
Privacy built into how we operate
StayPrivate operates StayPrivateMail and Keepd with data protection and privacy built into their design.
Where StayPrivateMail is used by an organisation to process personal information on its behalf, appropriate contractual and data-processing arrangements are available, including UK and EU GDPR processor terms, CCPA / CPRA service-provider provisions and HIPAA Business Associate Agreements where applicable.
Supporting your due diligence
Organisations in regulated and security-sensitive industries may need to conduct their own due diligence before using StayPrivateMail.
We can provide additional assurance information as part of an appropriate enterprise evaluation.
Secure communication. Their own copies.
Your business sends messages and shares files securely. Customers access and keep their own copies in Keepd, with a secure way to reply or upload files when needed. Their wider account stays private to them.
Try secure email from your customer’s side
Send a secure email to yourself. See how your customers access a message and shared files, keep their own copies and respond when needed.