Email Security Standard

How we secure corporate and client-facing email, from phishing protection to DLP and compliance.

Email Security

Field Value
Document ID STD-007
Classification Internal
Owner CTO (interim CISO)
Effective Date April 2026
Review Cycle Annual

This doc covers how we secure our two main email systems:

System Platform Purpose
Corporate Email Google Workspace (@wealthy.in) Internal and business communication.
Client/Partner Email AWS SES (via Skynet) Customer notifications, OTPs, reports, and marketing.

Part 1: Corporate Email (Google Workspace)

Security for our @wealthy.in accounts.

Email Authentication (SPF, DKIM, DMARC)

All three DNS records are required for email authentication:

Record Purpose Target State
SPF Authorizes sending IPs v=spf1 include:_spf.google.com include:amazonses.com -all
DKIM Signs outbound emails 2048-bit keys for both Google and AWS SES
DMARC Enforces policy p=reject (after monitoring and quarantine phases)

The SRE team conducts quarterly audits to verify these records.

Access Controls

  • MFA: Google 2-Step Verification is required for everyone in the organization.
  • OAuth Apps: Only approved third-party apps can access Google Workspace data.
  • Session Control: We enforce session timeouts (12 hours for web, 7 days for mobile) and limit concurrent sessions.
  • Mobile Devices: Mobile access requires Google Endpoint Management, a screen lock, and remote wipe capability.

Content Compliance & Data Loss Prevention (DLP)

We have rules in Google Workspace to detect and flag sensitive information:

Rule Pattern Action
PAN Number [A-Z]{5}[0-9]{4}[A-Z]{1} Flag and copy to security@wealthy.in
Aadhaar Number \b[2-9]{1}[0-9]{3}\s?[0-9]{4}\s?[0-9]{4}\b Flag and copy to security@wealthy.in
API Keys/Secrets Common secret patterns Flag and copy to security@wealthy.in

Recommendation: We should upgrade the action for outbound PII from monitor to reject or quarantine to prevent leaks.

Phishing Protection

We use Google Workspace’s built-in controls, which are all active:

  • ML-based phishing detection.
  • Post-delivery scanning to remove phishing messages from inboxes.
  • Spoofing detection and user-reported phishing workflows.

Our incident response SLA for phishing is:

  • Triage: 15 minutes
  • Contain: 30 minutes (block sender, remove emails, reset credentials)
  • Investigate: 2 hours

Attachment & Link Filtering

We block potentially malicious attachments, including:

  • Executables: .exe, .bat, .msi
  • Scripts: .js, .vbs
  • Disk images: .iso, .dmg

Password-protected archives are quarantined for manual review.

Part 2: Client & Partner Email (AWS SES)

This covers transactional and marketing emails sent via our internal tools, Skynet and Skynet-Go.

Architecture

Application (e.g., Falcon) ā†’ Skynet/Skynet-Go ā†’ AWS SES (Dedicated IP) ā†’ Client Inbox

Skynet-Go is our current multi-channel communication platform, handling email, SMS, push notifications, and more, using AWS SQS for queuing.

SES Configuration

Setting Value
Sending Domains Verified only
IP Addresses Dedicated (fully warmed up)
Bounce/Complaint Handling Automatic suppression list
Region ap-south-1 (Mumbai)

Skynet services use IAM roles with least-privilege permissions, not long-lived access keys.

Delivery Monitoring

We monitor delivery health closely:

Metric Threshold Action
Hard Bounce Rate > 5% Immediate review, pause sending if needed.
Complaint Rate > 0.1% Review content and check list hygiene.

Monitoring is done via CloudWatch, SNS, and our internal Skynet-Go dashboard.

Content Security

  • Templates: All emails use approved, version-controlled templates. No freeform composition is allowed.
  • PII Handling: We mask sensitive data like PAN and account numbers. Aadhaar numbers are never included in emails. OTPs are sent separately from other PII.
  • Anti-Spoofing: All client-facing emails are authenticated with SPF, DKIM, and DMARC.

Part 3: General Policies

User Awareness & Training

  • Phishing Simulations: We run half-yearly phishing exercises (plus ad-hoc campaigns). Our goal is a click rate below 5% and a report rate above 50%. Cadence is raised if either target is breached, per POL-025.
  • Security Training: Email security is covered in the annual Security Training Programme (T1) and in new-joiner onboarding, per POL-025 Security Awareness Training Policy.

Quarterly Audit

The security and operations teams perform a quarterly audit covering:

  • Verification of DNS auth records (SPF, DKIM, DMARC).
  • Confirmation of 100% MFA enrollment.
  • Review of DLP rules and OAuth app whitelists.
  • Analysis of SES bounce and complaint rates.

Contact

For any email security incidents or questions, contact the security team at security@wealthy.in.