Security

Every agency workspace is a separate tenant. Isolation is enforced at the database levelwith row-level security policies on every tenant table — not just in application code — so a request from one workspace can never read or write another workspace's records. Server-side APIs re-check tenant membership and role permissions on every call.

• All traffic is encrypted in transit with TLS.
• Data is encrypted at rest by our database and storage providers.
• Credentials for connected services (for example, mailbox connections) are stored encrypted, not in plaintext.

• Sign-in uses email one-time codes — no passwords to leak or reuse.
• Role- and permission-based access inside each workspace, managed by workspace owners.
• Internal access to production systems is limited to the small team operating the service and used only to run and support it.

• Public forms are rate-limited and spam-guarded.
• All API input is schema-validated at the boundary.
• Automated checks (static analysis, security-policy audits, tests) run on every change before it ships.

The platform runs on established cloud infrastructure providers that maintain their own independently audited physical and network security programs. Databases are backed up automatically, and we can restore to a recent point in time.

We are an early-stage product and do not yet hold formal certifications such as SOC 2 or ISO 27001. We would rather tell you that plainly than imply otherwise — the practices above are in place today, and formal audits are on our roadmap as the company grows.

If you believe you have found a security issue, email hello@example.com with details. We investigate every report, will keep you informed, and will not take action against good-faith research.