Built on infrastructure your security team will approve
SOC 2 certified hosting, row-level data isolation, signed webhooks, scoped API keys, and full audit logging — security by default, not by add-on.
SOC 2 Type II
Hosted on Supabase infrastructure — SOC 2 Type II certified. Your data is stored in audited, enterprise-grade data centers.
Row-Level Security
Every database query is scoped to the current workspace using Postgres RLS. One tenant can never access another's data.
HMAC Webhooks
All outbound webhooks are signed with HMAC-SHA256. Verify the signature to ensure every payload is authentic and untampered.
Scoped API Keys
Create API keys with granular scopes and configurable rate limits. Revoke instantly. Full access logs for every key.
Audit Log
Every action — logins, permission changes, channel connections, API key creation — is logged with actor, timestamp, and IP.
GDPR Deletion
Delete any contact's data permanently on request. Cascading deletion across messages, files, and CRM records.
Enterprise-grade, on every plan
Security features aren't locked behind the highest tier. Audit logs, rate limits, and error monitoring are available across all plans.
SSO (SAML)
Single sign-on via your identity provider — available on Scale and Enterprise plans.
Workspace Isolation
Each workspace is fully isolated — separate contacts, channels, team, billing, and data.
Rate Limits
Per-key and per-IP rate limiting on all API endpoints. Configurable thresholds, automatic blocking.
Error Log
Every failed delivery, webhook timeout, and API error — logged with stack traces and retry controls.
Compliance & certifications
Badge images coming soon. Contact us for current certification documents.
Security questions? We're an open book.
Book a call with our team to walk through architecture, compliance, and data handling.
Book a security review