How mail is handled

signplume manages signatures; it does not host your mailboxes. This page says what it sends, what it touches and what it keeps.

The mail signplume sends for you

signplume sends these mails for your organisation, from its own address:

Address confirmation, when someone creates an account.
Invitations, when an admin invites someone from People. An invitation is a single-use sign-in link to the person's own signature page.
Sign-in links, when a person asks for one on the sign-in page.
Payment failed, to your admins with a confirmed address, once when a payment first fails. Stripe's retries of the same charge send nothing more; a later failure, after a payment has gone through, mails again.
Messages to support, when someone writes to us from Help in the app or through their AI assistant. It goes to signplume support with what they wrote, their address and role and whether that address is confirmed, your organisation's name and id, its plan, how many people it has, the screen they wrote from and, when an assistant sent it, the assistant's name. We reply to their own address.
Setup reminders, when signplume has them switched on: a few mails to your admins with a confirmed address, while setup is unfinished and around the end of the trial. Each has a one-click unsubscribe.

They are listed on Mail with what the receiving server answered.

Bounces and spam complaints

When an address bounces hard (the mailbox does not exist) or its owner marks our mail as spam, signplume stops mailing it. The address shows under Suppressed addresses on Mail, where an admin can allow it again; that is recorded against the admin's name. A spam complaint never blocks a sign-in link the person asks for themselves, so one wrong click cannot lock them out, but it does stop invitations. A hard bounce stops both.

What each way of signing touches

Gmail push writes each person's Gmail signature setting, through the service account you connect on Directory sync. It reads no mail and changes nothing else in Gmail. See Gmail push.
The Outlook add-in runs while someone writes a message. It sends signplume the sender and the To and Cc addresses, so the right template can be picked. It never reads the subject or the body, and it never sends anything: the person still presses Send. See Deploy the Outlook add-in.
Copy and paste happens entirely in the person's own mail client. signplume never sees the result, which is why a pasted signature shows as marked installed, never as signing.
The relay, set up on Server-side signing, is the only way your mail itself passes through signplume.

Mail through the relay

The relay stamps the signature into each message as it arrives and writes the stamped message to its spool, on signplume's server, before it accepts it. From the spool it is handed back to your mail platform for delivery.

The hand-back requires TLS. A next hop that offers no encryption is refused, and the message waits with the reason rather than travelling in the clear. (The one exception is a self-hosted mail server that cannot do TLS, switched on for an organisation only by whoever runs the signplume server; Server-side signing shows a warning when it applies to you.)
A message is deleted the moment the hand-back succeeds. A message that cannot be delivered is kept for up to 7 days, so the failure can be looked into, and is then deleted. Messages that are retrying or given up show on Mail.
The relay keeps no copy of delivered mail, and nothing is kept for analytics.
The header your routing rule adds so the relay can recognise your mail is removed before the message leaves.
Mail from a person with Signatures off passes through without a signature.

Images and links in signatures

Logos, photos, banners and badges are hosted by signplume, and your recipients' mail clients fetch them over HTTPS when a message is opened. With click tracking on (see Campaigns), signature links go through signplume so clicks can be counted per campaign. It never stores who clicked: no addresses, no IP addresses, no cookies.

How long records are kept

Mail delivery records (sends and bounces): deleted after 90 days.
Messages the relay could not deliver: kept for up to 7 days.
Images nothing uses any more, such as a replaced photo or logo: deleted after 30 days.
The audit log on Activity: kept for 12 months.

This processing is covered by the Data Processing Agreement.