Customer story - ČSOB Group
Security controls designed with ČSOB's IT security team, click data flowing back into Bloomreach, and compliant archiving for regulated communication, across six brands in three countries.
Published 2026
01 - The challenge
In 2022 ČSOB moved its email marketing to Bloomreach Engagement and chose Omnivery to deliver it, with Etnetera as integration partner.
Omnivery's 100% owned infrastructure, rather than public cloud, met ČSOB's audit requirements. But the bank's IT security and risk teams had a harder question. If a marketing platform or delivery provider were ever compromised, an attacker could send convincing phishing in ČSOB's name. The bank needed a way to make sure only legitimate email could reach its clients, and to stop sending instantly if anything looked wrong.
Two more requirements followed: marketing wanted its engagement data to stay in Bloomreach, and regulated group companies had to archive what they sent.
02 - Security controls
Omnivery worked through ČSOB's risk scenarios with its IT security, risk and digital channels teams, in workshops at the bank's headquarters in early 2023. ČSOB set out the controls it needed; Omnivery built them into the platform as standard features, checked on every message before it is delivered.
Each sending domain has a list of approved link destinations. An email containing any other link is blocked before it reaches a client, so a hijacked campaign can't point to a phishing site.
The Reply-To address must belong to the sending domain, so replies can't be quietly diverted to an outside address.
Sending for any domain can be switched off instantly from the console or the API, stopping a campaign mid-send.
Every change to these settings is reported to a dedicated bank security address, which can verify it and react. Changing that address alerts the previous one.
Omnivery counts messages that fail validation, so an unusual run of blocked emails stands out as a possible sign of compromise rather than getting lost in the logs.
ApprovedSecurity sign-off
On the strength of these controls, ČSOB's IT Security and Risk & Compliance teams approved sending directly from Bloomreach Engagement through Omnivery, instead of building a separate bank-operated filtering layer in between.
"We needed to be sure that even if a platform upstream were compromised, no email with a phishing link could reach our clients. Omnivery built the controls we specified within weeks, which let our IT security and risk teams approve direct sending."
Vladimír Selčan, IT Solution Architect, Digital Channels, ČSOB
03 - Bloomreach integration
The URL allowlist checks the real destination of every link, so links can't be rewritten into a marketing platform's tracking redirects. Omnivery tracks the clicks instead. Without this, there would have been a gap in ČSOB's campaign reporting.
Campaigns built and scheduled by ČSOB's marketing team
Checks links, Reply-To and domain status, then delivers and tracks clicks
Only email that passes every check is delivered
Click events. Each click goes back into Bloomreach as a native campaign event, matched to the right campaign and customer.
Omnivery built a dedicated Bloomreach events integration in a day, then refined it with Bloomreach's team so each click carries the campaign metadata ČSOB's existing reports depend on. Opens continue to be tracked in Bloomreach, so nothing is counted twice.
04 - Compliant archiving
Banks and investment firms must be able to prove what they told each client, content included, for years. For Patria Finance this is a MiFID requirement, and ČSOB has the same need for its own client communication.
Copying every email from every sending system would have meant changes in each of them. Instead, Omnivery added journaling: an identical copy of every email on a domain goes to a designated archive address. It is switched on in the domain settings, with no changes to the systems that send the email.
Per domainOne setting, every system
Live at Patria Finance, where client email is archived to meet MiFID record-keeping requirements.
05 - Results
Approved
Omnivery's controls met the bank's security and risk requirements.
100M+
Six brands in the Czech Republic, Slovakia and Hungary.
Ahead
Fully released more than two months before ČSOB needed it.
Intact
Clicks arrive as native campaign events in existing reports.
"We got the security sign-off without losing anything in Bloomreach. Our campaign reporting works exactly as before."
Jan Kuběna, Technology Platform Designer, Lead Management, ČSOB
06 - Key takeaways
A URL allowlist keeps phishing links out of email sent in your name, even if a platform upstream is compromised.
ČSOB's requirements shipped as standard platform features, available to every regulated sender.
Moving click tracking for security reasons didn't cost ČSOB its Bloomreach reporting.
Journaling in one place covers every system that sends email, with no changes necessary in any of them.
At a glance
ČSOB Group, part of KBC Group
ČSOB, ČSOB Pojišťovna, ČSOB Leasing, ČSOB Stavební spořitelna, usetreno.cz, Patria Finance
Bloomreach Engagement, plus internal systems at Patria
Etnetera
2022
Key facts
Sending email in a regulated industry?
100% owned infrastructure, ISO 27001 certified, with security controls built for banks and insurers.