- Data in transit
- All traffic uses TLS.
- Data at rest
- Stored with our database and hosting providers, which encrypt at rest (see the sub-processor list).
- Tenant isolation
- Every table is protected by row-level security tied to the business's own members. Cross-account access was attack-tested.
- Secrets
- API keys and provider credentials live on the server only and are never shipped to the browser.
- Payments
- Card data goes straight to Stripe. We store Stripe identifiers, never card numbers.
- Webhooks and jobs
- Inbound webhooks are signature-verified. Scheduled jobs refuse to run without their secret.
- Abuse controls
- Rate limits on public forms, recipient opt-out on every message, and a report route that can pause a sender.
- Monitoring
- Automatic checks of sign-in, pricing, payments and scheduling, with a public status page.
- Incident process
- Critical failures page the on-call founder immediately, are published on the status page, and get a written postmortem. Affected customers are told without undue delay, as the law requires.
- Your data
- Export and deletion on request, answered within 30 days and aimed at 7.