Your list and your domain are the two things you cannot get back

We hold client prospect data, and we send from infrastructure that carries a client’s name. Both are hard to repair once damaged, so we treat security and sending discipline as part of the service rather than as a policy document.

Independently attested

We hold a NIST cybersecurity attestation, verifiable at lockwell.co/nist/creatop.

We follow the rules that apply to outbound

GDPR and CAN-SPAM, including a lawful basis for B2B contact, honouring opt-outs immediately and permanently, and accurate sender identification.

Data is stored and moved securely

Encrypted in transit and at rest, with access limited to the people delivering the work.

Sending discipline is enforced, not aspirational

Warmup runs for a minimum of 14 days before any campaign sends, and never turns off. Volume is capped per mailbox. Campaigns pause automatically if bounce rates cross 4%. These are operating rules, not targets.

Ownership is a security property

Because the system we build belongs to the client, their data is not locked inside a platform we control. They can export it, keep it, or take it in-house at any time. That is a security property as much as a commercial one.

Reporting

Security concerns: privacy@creatop.net.

Last updated: 6 August 2026