1. Email We Send
OathNet uses email only for transactional and service-related communications. These messages help operate, secure, and support the services a recipient has requested or uses.
Transactional and service email may include:
- Account verification messages
- Password reset instructions
- Security and account notices
- Billing confirmations and receipts
- Responses to support requests
- Scanner notifications enabled by an authenticated user
OathNet does not use Amazon SES for cold outreach, unsolicited marketing, purchased recipient lists, or bulk prospecting.
2. How We Obtain Recipient Addresses
We send email only to addresses provided directly by:
- A user registering or managing an OathNet account
- A customer providing an authorized billing or organization contact
- A person contacting OathNet Support
- An authenticated user enabling email notifications for a scanner
Email addresses appearing in breach records, stealer logs, credential data, search results, public profiles, or other intelligence sources are never used as recipients.
OathNet does not purchase, rent, scrape, or obtain recipient lists from third parties.
3. Scanner Notifications
Scanner notifications are sent only when an authenticated user creates a scanner and selects email as the notification channel.
Scanner emails contain a minimal event summary and a link to sign in securely to OathNet. They do not include:
- Passwords or credential pairs
- Session cookies
- Authentication tokens
- Raw stealer logs
- Downloadable archives
- Complete breach records
Users can stop scanner emails by pausing or deleting the scanner, or by selecting another notification channel.
4. Bounces and Complaints
OathNet uses Amazon SES account-level suppression for hard bounces and complaints. An address suppressed after a hard bounce or complaint is excluded from future delivery attempts.
We monitor SES sending reputation and investigate unexpected increases in bounce rates, complaint rates, or sending volume.
5. Email Authentication and Security
OathNet email is sent using verified oathnet.org identities protected by:
- DomainKeys Identified Mail (DKIM)
- Sender Policy Framework (SPF) through a custom MAIL FROM domain
- Domain-based Message Authentication, Reporting, and Conformance (DMARC)
- TLS-secured delivery
- Restricted production sending credentials
Email links use official OathNet HTTPS domains. OathNet will never ask a recipient to send passwords, authentication tokens, or exposed credentials by email.
6. Optional and Promotional Email
OathNet does not currently use Amazon SES for promotional campaigns.
If optional promotional email is introduced, it will be sent only with appropriate consent and will include a clear unsubscribe mechanism. Unsubscribe requests will be applied before any further optional messages are sent.
7. Reporting Unexpected Email
If you receive an unexpected OathNet email or believe your address was used without authorization, contact [email protected].
Include the email subject and approximate delivery time. Do not include passwords, authentication tokens, or sensitive breach information.
OathNet investigates abuse reports and applies suppression when appropriate.