Security & Compliance

SpamFoo is designed with privacy as a core architectural principle. All email classification happens locally on your server.

Local-First Processing

The SpamFoo client runs entirely on your mail server. When an email arrives, SpamFoo analyzes the headers, authentication results, body text, and metadata using local ML models and returns a classification result. No email content, subject lines, or recipient lists are sent to SpamFoo's servers when analyzing an email.

The only data SpamFoo transmits externally is:

  • License validation: Your license key and a server identifier, sent periodically to verify your subscription.
  • Model updates: SpamFoo checks for updated ML models and downloads them from the CDN. No email data is included in these requests.
  • Reputation metrics: SpamFoo reports aggregate counts of mail received per sending domain and IP address to SpamFoo's reputation services, and uses them in return to identify bad actors.
  • Anonymized feedback: When enabled, aggregated classification corrections are sent to SpamFoo's Global API to improve models. Email content is converted to mathematical embeddings from which the original text cannot be recovered.
  • Deep feedback: Individual users may choose to consent to allowing sanitized versions of the email content of their corrections to be sent in addition to the mathematical embeddings. This allows the emails to be used to better train the models than just the embeddings. Consent can be granted or revoked at any time.
Note to Implementers: You must never assume consent by a user. Consent must be explicitly granted to allow deep feedback to be sent.

Data Retention

SpamFoo automatically deletes data based on retention schedules. Local retention is configurable through the admin console.

Data Default Retention Location
Classification records 7 days Local (your server)
Aggregate statistics 90 days Local
Log files 30 days Local
Personalization data Indefinite (until user deletion) Local (your server)
Anonymized feedback 2 years SpamFoo servers

Access Control

  • Local API: The SpamFoo client listens on localhost only. No authentication is required for local access because the API is not network-accessible by default.
  • Admin console: Accessible through SmarterMail's authenticated interface, or via a reverse proxy you configure with your own authentication. See Setting Up Remote Access.

Logging

SpamFoo writes system activity, classification processing, updates, and errors to local log files. Logs are kept for 30 days and are viewable in the admin console under System > Logs.