1.0Purpose & Scope

This Email Communication Policy (the “Policy”) establishes the minimum security, privacy, and operational requirements for electronic mail sent or received by dotCLOUD LLC (“dotCLOUD”, “we”, “us”) and our clients (“Client”, “you”) in the course of any commercial, contractual, or advisory relationship.

The Policy applies to:

• All employees, contractors, and authorised representatives of dotCLOUD LLC.
• All Client personnel who exchange email with dotCLOUD using a dotCLOUD-controlled domain.
• All inbound and outbound messages, attachments, calendar invitations, and automated notifications.
• All systems involved in the transmission, processing, or storage of such messages.

2.0Definitions

3.0Standards & Frameworks

dotCLOUD LLC aligns its email-security controls with internationally recognised standards. This Policy is designed to operate consistently with, and to support Client compliance under, the following:

Where Client-specific frameworks impose stricter controls (e.g., national defence classifications, central-bank guidance, or law-enforcement chain-of-custody requirements), such Client requirements prevail and are addressed in a written annex to the master service agreement.

4.0Authoritative Email Domains & Service Providers

Genuine email correspondence from dotCLOUD LLC originates exclusively from the domains listed below, hosted on the service providers indicated. Messages purporting to originate from dotCLOUD but using any other domain, or any look-alike variant (e.g., punycode, character substitution, or additional sub-labels), must be treated as suspicious and reported under Section 13.

4.1  Standard Business Correspondence — Microsoft Exchange Online

The following domains are operated on Microsoft Exchange Online, protected by Microsoft Defender for Office 365 and Exchange Online Protection (EOP), and are used for day-to-day business correspondence subject to the controls defined in Sections 5, 6, and 8 of this Policy:

4.2  High-Assurance Encrypted Correspondence — Proton Mail

For correspondence requiring end-to-end encryption by default, including communications with financial institutions, government agencies, defence, intelligence, and law-enforcement clients, dotCLOUD operates a separate, segregated mail environment on Proton Mail (Proton AG, Switzerland), governed by Swiss data-protection law and hosted exclusively in Swiss jurisdiction:

4.3  Domains Not Listed

dotCLOUD does not use free webmail providers (e.g., Gmail, Outlook.com, Yahoo, GMX), generic consumer addresses, or any domain not explicitly listed in Sections 4.1 or 4.2 for business correspondence. The list above is kept synchronised with the public DNS records of each domain and with the security.txt file (RFC 9116) published at each domain’s /.well-known/ path.

5.0Transport Security

All email exchanged with dotCLOUD authoritative domains is transmitted over secured transport channels. Both the Microsoft Exchange Online environment (Sections 4.1) and the Proton Mail environment (Section 4.2) inherit transport-security baselines from their respective providers and are further hardened by dotCLOUD configuration:

• Opportunistic and enforced TLS using TLS 1.2 minimum, TLS 1.3 preferred, in accordance with NIST SP 800-52 Rev. 2 and RFC 8996.
• MTA-STS (RFC 8461) policy published in enforce mode for all authoritative domains.
• SMTP TLS Reporting (TLS-RPT, RFC 8460) enabled for continuous monitoring of negotiation failures.
• DANE/TLSA (RFC 7672) records published where DNSSEC is available end-to-end (default for the Proton Mail domain dotcloud.red).
• Cipher suites restricted to AEAD constructions (AES-GCM, ChaCha20-Poly1305); legacy ciphers disabled.
• Exchange Online Protection (EOP) and Microsoft Defender for Office 365 provide inbound and outbound filtering, anti-malware, anti-phishing, Safe Links, and Safe Attachments on the Exchange Online domains.
• Proton Mail additionally enforces zero-access encryption at rest, meaning that Proton itself cannot decrypt message content stored on the dotcloud.red domain.

dotCLOUD will not knowingly transmit Sensitive Information over an unencrypted SMTP session. Where a Client’s receiving infrastructure does not advertise STARTTLS, the message will be queued, the Client notified, and an alternative secure channel offered — typically delivery via the Proton Mail environment described in Section 4.2.

6.0Sender Authentication

To prevent spoofing and impersonation, dotCLOUD publishes and enforces the following DNS-based authentication records on every authoritative domain:

Clients are strongly encouraged to deploy equivalent records on their own domains. Failure of a Client’s outbound message to authenticate may result in quarantine or rejection by dotCLOUD’s gateway in line with the published DMARC policy of the sending domain.

7.0End-to-End Encryption

Beyond transport security, dotCLOUD supports message-level encryption for correspondence involving Sensitive Information. The following options are available, and at least one is mandatory for the sectors listed in Section 15:

• Proton Mail end-to-end encryption via the dotcloud.red domain. Mail exchanged between two Proton Mail accounts is automatically end-to-end encrypted using OpenPGP under Proton’s zero-access architecture. For recipients outside the Proton ecosystem, dotCLOUD uses Proton’s Password-Protected Email feature (symmetric AES encryption with a shared secret exchanged out-of-band) or standard OpenPGP with the recipient’s published key. This is the recommended default channel for all Confidential and Restricted correspondence with sensitive-sector Clients.
• S/MIME (RFC 8551) on the Exchange Online domains, using certificates issued by a publicly trusted CA or a Client-designated PKI; minimum RSA-3072 / ECC P-256.
• OpenPGP (RFC 9580) with Curve25519 or RSA-4096 keys; fingerprints published via Web Key Directory (WKD) on the relevant domain and on this website.
• Microsoft Purview Message Encryption (OME) on the Exchange Online domains for Client environments that do not support S/MIME or PGP, providing rights-managed, authenticated, time-limited delivery.

8.0Data Classification & Handling

All information transmitted by email is classified according to the following scheme:

9.0Acceptable Use

dotCLOUD personnel and Clients agree, in the course of email correspondence, to:

• Use email solely for legitimate business purposes related to the engagement.
• Address messages only to recipients with a demonstrable need to know.
• Refrain from forwarding dotCLOUD correspondence to personal or unaffiliated accounts.
• Not attempt to circumvent, disable, or weaken the security controls described in this Policy.
• Comply with all applicable laws, including export-control, sanctions, and data-protection law.

10.0Phishing & Impersonation

dotCLOUD will never, under any circumstances:

• Request your password, multi-factor authentication code, or recovery codes by email.
• Request payment to a new or amended bank account by email alone, without out-of-band confirmation.
• Send unsolicited attachments containing executable files, macro-enabled documents, or password-protected archives without prior arrangement.
• Pressure you to act urgently outside established procedures.

Any message that appears to originate from dotCLOUD and contains one or more of the above elements should be considered a phishing or business-email-compromise (BEC) attempt and reported under Section 13.

11.0Client Obligations

To preserve the security guarantees of this Policy, Clients undertake to:

1. Maintain accurate, up-to-date contact lists and notify dotCLOUD promptly of personnel changes.
2. Operate their own email infrastructure with at least equivalent SPF, DKIM, and DMARC enforcement.
3. Verify dotCLOUD public-key fingerprints out-of-band before encrypted exchange.
4. Refrain from forwarding dotCLOUD correspondence containing Confidential or Restricted information to third parties without prior written consent.
5. Report suspected phishing, spoofing, or compromise without undue delay (Section 13).

12.0Retention & Archiving

E-mail subject to retention obligations is preserved in a tamper-evident archive in jurisdictions agreed with the Client, with cryptographic integrity verification and access logging. Default retention periods are:

13.0Incident Reporting

Suspected security incidents involving dotCLOUD email — including phishing, spoofing, lost devices, accidental disclosure, or compromise of credentials — must be reported to the dotCLOUD Security Operations Centre (SOC) without undue delay and, in any case, within 24 hours of becoming aware.

• Email (encrypted, preferred): security@dotcloud.red — end-to-end encrypted via Proton Mail
• Email (standard): security@dotcloud.pro — OpenPGP-encrypted preferred
• Telephone (24/7): +41 43 217 80 40
• Web form: https://dotcloud.pro/security/report

For confirmed personal-data breaches, dotCLOUD will assist Clients in meeting their 72-hour notification obligation under GDPR Art. 33 and equivalent national obligations.

14.0Out-of-Band Verification

15.0Provisions for Sensitive Sectors

The following enhanced controls apply by default to engagements with banks and other financial institutions, central banks, defence and armed forces, intelligence services, police and other law-enforcement agencies, judicial bodies, healthcare providers handling patient data, and operators of critical infrastructure.

• Mandatory end-to-end encryption (Proton Mail via dotcloud.red, S/MIME, or OpenPGP) on all Confidential and Restricted correspondence; the Proton Mail channel is used by default unless the Client requests otherwise.
• Use of dedicated, segregated mailboxes for the engagement.
• Personnel handling the correspondence undergo enhanced background checks consistent with the Client’s vetting requirements.
• Storage and processing limited to jurisdictions agreed in writing with the Client.
• No use of third-party machine-learning services on message content unless expressly authorised.
• Immutable audit logging with cryptographic chain-of-custody, retained for the period required by the Client’s regulator.
• Right of audit and right to require destruction of correspondence on termination.

Additional or alternative controls (e.g., classified-network gateways, hardware-token signing, sovereign cloud hosting) are available on request and are documented in a sector annex to the master service agreement.

16.0Compliance & Audit

dotCLOUD’s information-security management system is subject to independent internal and external assessment. Clients with a contractual relationship may, on reasonable notice and subject to confidentiality obligations:

• Receive copies of current ISO/IEC 27001 and SOC 2 Type II reports.
• Request evidence of DMARC, MTA-STS, and TLS-RPT configuration.
• Conduct or commission an audit of the controls described in this Policy, scoped to their engagement.

Non-compliance with this Policy by dotCLOUD personnel is treated as a disciplinary matter and may result in termination of employment and referral to the competent authorities where criminal conduct is suspected.

17.0Contact

For questions regarding this Policy, please contact: