# Security

URL: https://ventexr.com/security/

Updated: 2026-10-17

We do not run cold outreach from your primary domain. Instead we set up and warm separate sending domains with their own mailboxes and their own SPF, DKIM and DMARC records. If a sending domain has a deliverability problem, it does not affect your main domain's email, because the two are kept separate.

- [Home](https://ventexr.com/)
- Security

Vendor security review

How VentexR keeps risk to your domain low, handles the data it works with, and hardens its own website. This page describes what we actually do, and stops short of certifications we do not hold.

Last updated October 1, 2026 · Describes current practice, no certifications claimed

## How VentexR keeps risk low

Three practices cover your domain, your data and our own website.

### Your main domain stays out of it

We do not run cold outreach from your primary domain. Outreach goes out from separate sending domains, which lowers the risk to your main domain's reputation.

Separate sending domains

### Website hardening

This website runs on a self-managed server with HTTPS and security headers, a database that only listens locally, protected configuration files, and script execution blocked in the uploads folder.

Documented measures

### B2B outreach, opt-outs honoured

We work with business contacts on a legitimate-interest basis, and every message gives a clear way to opt out. Your own obligations depend on your situation, so speak to your legal adviser.

Clear opt-out in every message

## Separate sending infrastructure

Some outbound set-ups ask for mailboxes on your main corporate domain, which puts your everyday email deliverability at risk. Here is how we keep that risk down.

### Dedicated Secondary Infrastructure

For each client we set up separate sending domains (typically 6 to 10, depending on volume). They use their own mailboxes and DNS records, separate from your corporate workspace.

- No access to your internal Google or Microsoft directory
- Their own MX records, SPF, DKIM and DMARC
- Redirects send anyone who visits a sending domain to your homepage

### Access to your systems

We ask for the least access needed. If a CRM connection is required, the scope is agreed with you first and you can revoke it at any time.

- Scope agreed with you before anything is connected
- Access you can revoke at any time
- We do not export or copy your customer database

## Data and opt-outs

How we approach personal data in B2B outreach. This is our approach, not legal advice.

### GDPR Legitimate Interest Standard

GDPR Article 6(1)(f) allows processing where there is a legitimate interest that is not overridden by the individual's rights. For B2B outreach that means a clear link between what is offered and the recipient's professional role.

- The basis for outreach is written down for each engagement
- Clear business purpose directly aligned with ICP titles
- A clear opt-out in every message, honoured promptly

### Suppression & Do-Not-Contact Lists

When a prospect replies negatively or asks to be removed, they are added to a suppression list and not contacted again.

- Applied across every sending mailbox in the engagement
- Checked against your own do-not-contact list before launch
- Kept on record so removed contacts stay removed

Need to complete a vendor security review?

Tell us what your security team needs to see and we will answer in writing. Contact security@ventexr.com.

## Questions and answers

### Does VentexR ever send cold email from our primary corporate domain?

No. Outreach goes out from separate sending domains set up for the engagement, so your primary domain is not used for cold outreach.

### Where is campaign data stored?

Campaign records live in the tools used to run your outreach, such as sending, CRM and reporting tools, so the location depends on those providers. We can list the providers used for your engagement on request. This website runs on a self-managed server with the hardening measures described above.

### Do you collect or process personal data?

We work with business contact details such as work email, job title and company. We do not collect payment card data or health information. Business contact details can still be personal data under GDPR, which is why we take opt-outs and legitimate interest seriously.

### What is your vulnerability disclosure policy?

If you believe you have found a security issue in any VentexR system or web property, email security@ventexr.com. We will acknowledge your report and keep you updated.

### Can our security team review a data processing agreement?

Yes. Ask, and we will work through it with your team. Tell us what your security and legal reviewers need and we will answer in writing.