Unified Email Manager / Security & Privacy
Put permission, identity and safe stopping around the send.
Unified Email Manager separates management access, Marketing permission, recipient identity and operational progress. Its safeguards work alongside your WordPress permissions, hosting and mail provider.
Give consequential controls to authorized staff.
Administration uses the configured management capability, normally administrator-level management permission. The plugin does not create a separate marketing-manager or finance role. Staff who can preview orders or choose test recipients need authorization to inspect that customer information.
Administrative requests check access and intent. Typed object checks keep a campaign operation from becoming an arbitrary order change. Public signup/recovery forms add context-specific signed evidence, input bounds and throttling. Configured provider callbacks authenticate their own supported proof.
Different records receive different protection.
The normal analytics ledger avoids full message bodies, attachment contents and full headers. Permission/frequency records use keyed identities. Newsletter addresses and cart recovery identity use authenticated encryption, as does the installation credential in its separate context.
Template sender/custom-recipient configuration and provider verification secrets are different storage classes; they are not all encrypted by the license vault. Backups, administrator database access, hosting logs and external providers still require appropriate protection.
Live confirmation, unsubscribe and recovery links are sensitive capabilities. Recovery grants limited cart-restoration ability, not account login. A site move needs coordinated URL, database and deployment-secret continuity.
Unsubscribe and stopping remain available.
Marketing permission is checked separately from audience relevance. Suppression is a stronger stop than an ordinary grant. A later unsubscribe can block a previously reviewed queued recipient.
Stored contacts, templates, history and recipient restrictions remain when operational access is held. Unsubscribe and privacy protections stay available. Restore the current UEM license before resuming licensed management, creation or sending workflows.
Saved templates, definitions, audiences, history and consent are not deleted because access is unavailable. Different workflows handle interruptions and resumption differently; the progress reason explains what action is appropriate.
Permission remains part of sending
- Consent
Read the permission appropriate to the message.
- Suppression
Respect unsubscribes and recorded stops.
- Authorization
Use the permitted controls to start the run.
- Activity
Inspect what the local system and provider reported.
Privacy tools preserve the stops that matter.
Supported native exporters and erasers cover newsletter and recovery-owned records, with credentials and usable tokens omitted. Erasure preserves the protective keyed suppression needed to keep removing a contact from becoming permission to send again.
UEM’s privacy handlers do not erase source-owned orders, accounts, native email settings or another plugin’s transport credentials. Whole-site privacy handling also involves the systems that own those records.
Messages are submitted to the configured transport, provider callbacks bring feedback, and stored remote images can load in a browser or email client. These are real data flows to consider in your own privacy disclosures and deployment controls.