Security

Last reviewed 2026-09-03.

Product security

Campaign sending is dry-run by default: Real sends require an explicit, logged production switch — safe is the fallback, never the exception.
Approval before consequential action: Audience, sender, suppression and estimated cost are visible before a batch executes.
Daily send cap: Real sends are hard-capped per day; the queue stops itself at the limit.
Audit trail: Who decided what, when — audit rows outlive the records they describe, so a deletion remains provable.
Role-based access: Named users only; roles scope what a member can see and do.
Export included: Structured export of records and history is included; it is not held back for a higher tier.

Data security

Encryption in transit: TLS 1.2 or better on every connection, including internal service traffic.
Encryption at rest: Databases and object storage encrypted; contact emails carry a keyed blind index so the directory cannot be read as a plaintext list.
Tenant isolation: Every query is organisation-scoped; an automated test matrix and a static lint fail the build if a query loses its scope.
Backups and recovery: Continuous backups; restore drills are recorded and an overdue drill raises an operational alert.

Access control

Server-side authorisation: Every API route authorises on the server; a redirect in the browser is a convenience, never the access check.
Least-privilege staff access: Role-scoped and time-boxed.
Logged support access: Every support impersonation is logged and visible to the affected workspace.
Session controls: HttpOnly, secure session cookies; sessions expire.

Infrastructure security

Managed, patched platforms: Vercel for compute and edge, Neon for Postgres — provider certifications inherited; each provider's own terms are linked from the subprocessor list.
Separate environments: Development and production use separate databases and credentials; dev stays in dry-run test mode.
Secrets in the environment only: Provider credentials live in environment configuration, never in the repository.
Migrations own the schema: Schema changes are versioned, reviewed and applied by migration — never by hand on production.

Organisational security

Confidentiality and training: Personnel with access are bound by confidentiality; security training on joining and annually.
Onboarding and offboarding: Access granted by role on joining, revoked on leaving, reviewed on change.
Vendor review cadence: Subprocessors reviewed at least annually; the review date is published and staleness fails the site build.
Incident response: A written response plan with customer notification commitments in the DPA.
Periodic risk assessment: A documented organisation-wide risk assessment (product, data, vendors, AI) runs at least every six months and after material architecture or subprocessor changes; findings are recorded, gaps are tracked to a fix, and completed cycles are announced in the updates feed. The process is defined; the first cycle is tied to the SOC 2 observation window and the feed will carry its record.
Independent control review: Control operation is reviewed on a named cadence by someone other than the implementer: quarterly, the reviewer walks the controls inventory against its evidence (guards, tests, audit trail) and records the outcome; failures are tracked to a fix. The cadence is defined; reviews are announced in the updates feed, and no one signs off their own work.

AI

AI proposes, people decide: Models draft, classify and propose; consequential messages, merges and actions remain attributable to a person and reviewable before execution.
AI providers are subprocessors: Any model provider that touches customer data appears in the subprocessor list like any other provider — no unlisted AI.
No training on your data: Customer data is not used to train foundation models; provider terms are selected and linked accordingly.
Metered and capped: AI is a licensed capability with visible usage, budgets and hard caps — never an invisible background cost.

Availability

Public status page: Live status and incident history on the public status page.
Recovery objectives: Backup and restore objectives stated in the security overview and tested by drill.
Incident communication: Incidents are acknowledged on the status page and closed with a written summary.

Security

Last reviewed 2026-09-03.

Product security

Campaign sending is dry-run by default: Real sends require an explicit, logged production switch — safe is the fallback, never the exception.
Approval before consequential action: Audience, sender, suppression and estimated cost are visible before a batch executes.
Daily send cap: Real sends are hard-capped per day; the queue stops itself at the limit.
Audit trail: Who decided what, when — audit rows outlive the records they describe, so a deletion remains provable.
Role-based access: Named users only; roles scope what a member can see and do.
Export included: Structured export of records and history is included; it is not held back for a higher tier.

Data security

Encryption in transit: TLS 1.2 or better on every connection, including internal service traffic.
Encryption at rest: Databases and object storage encrypted; contact emails carry a keyed blind index so the directory cannot be read as a plaintext list.
Tenant isolation: Every query is organisation-scoped; an automated test matrix and a static lint fail the build if a query loses its scope.
Backups and recovery: Continuous backups; restore drills are recorded and an overdue drill raises an operational alert.

Access control

Server-side authorisation: Every API route authorises on the server; a redirect in the browser is a convenience, never the access check.
Least-privilege staff access: Role-scoped and time-boxed.
Logged support access: Every support impersonation is logged and visible to the affected workspace.
Session controls: HttpOnly, secure session cookies; sessions expire.

Infrastructure security

Managed, patched platforms: Vercel for compute and edge, Neon for Postgres — provider certifications inherited; each provider's own terms are linked from the subprocessor list.
Separate environments: Development and production use separate databases and credentials; dev stays in dry-run test mode.
Secrets in the environment only: Provider credentials live in environment configuration, never in the repository.
Migrations own the schema: Schema changes are versioned, reviewed and applied by migration — never by hand on production.

Organisational security

Confidentiality and training: Personnel with access are bound by confidentiality; security training on joining and annually.
Onboarding and offboarding: Access granted by role on joining, revoked on leaving, reviewed on change.
Vendor review cadence: Subprocessors reviewed at least annually; the review date is published and staleness fails the site build.
Incident response: A written response plan with customer notification commitments in the DPA.
Periodic risk assessment: A documented organisation-wide risk assessment (product, data, vendors, AI) runs at least every six months and after material architecture or subprocessor changes; findings are recorded, gaps are tracked to a fix, and completed cycles are announced in the updates feed. The process is defined; the first cycle is tied to the SOC 2 observation window and the feed will carry its record.
Independent control review: Control operation is reviewed on a named cadence by someone other than the implementer: quarterly, the reviewer walks the controls inventory against its evidence (guards, tests, audit trail) and records the outcome; failures are tracked to a fix. The cadence is defined; reviews are announced in the updates feed, and no one signs off their own work.

AI

AI proposes, people decide: Models draft, classify and propose; consequential messages, merges and actions remain attributable to a person and reviewable before execution.
AI providers are subprocessors: Any model provider that touches customer data appears in the subprocessor list like any other provider — no unlisted AI.
No training on your data: Customer data is not used to train foundation models; provider terms are selected and linked accordingly.
Metered and capped: AI is a licensed capability with visible usage, budgets and hard caps — never an invisible background cost.

Availability

Public status page: Live status and incident history on the public status page.
Recovery objectives: Backup and restore objectives stated in the security overview and tested by drill.
Incident communication: Incidents are acknowledged on the status page and closed with a written summary.