Security best practices

The product protects what you give it. These habits limit what you give it and who can reach it. Most take a few minutes.

The checklist

1. Create a dedicated key for OutboundManager in each tool. Do not reuse a key that another integration uses.
2. Give each key the minimum scopes. Add write scopes only for a feature you actually use.
3. Keep two admins, no more than you need, and make everyone else a manager or rep.
4. Use a unique password of 16 characters or more from a password manager.
5. Share keys through the form only. Never paste a key into chat, email or a ticket.
6. Replace keys when the person who created them leaves, and on a regular schedule.
7. Review Settings → Team every quarter and remove anyone who no longer needs access.

Keys

One key per integration

Name the key "OutboundManager" where the tool lets you. If the key ever has to be revoked, you revoke one integration and nothing else breaks. It also makes the tool's own access log readable.

Least privilege

The full minimum per tool is in API keys by tool.

Keys that belong to a person

Some tools tie a key to the user who created it rather than to the account. That key stops working, or keeps that person's access alive, when they leave.

Where the tool allows it, create these keys from a shared admin or service user instead of a rep's account.

Rotating a key

1. Create the new key in the tool.
2. In Settings → Connections, open the tool and use Replace key. The new key is tested before it is saved.
3. Revoke the old key in the tool.

Important: Do the steps in that order. Revoking first puts the connection into "Needs attention" until the new key is saved. And never remove the connection to rotate: that deletes its synced history.

Roles

• Admin can read every key's status, replace and remove keys, pay, and delete the workspace. Give it to the workspace owner and one backup.
• Manager sees all team data and can answer any reply, but cannot touch connections, enrichment keys or billing. This is the right role for team leads.
• Rep sees only their own data. Give it to everyone who only needs their own numbers.
• Always link a rep's login to their own rep record, so they see their own data and nobody else's.

The exact permission list is in Team, roles and permissions.

Settings: Team

Settings → Team shows who has which role. Review it every quarter. Demo data.

Logins

• There is no two-factor authentication yet, so the password is the only barrier. Make it long and unique.
• One login per person. Do not share a login: activity such as reply assignments is recorded against it.
• Invite links are single-purpose, tied to one email address and valid for 14 days. Send them through a channel you trust, and cancel a pending invite you no longer need.
• Sign out on shared computers. A session lasts 30 days.

When someone leaves

1. Remove them in Settings → Team. Access to the workspace ends at once.
2. Replace any API key they created in a tool, especially the person-bound ones above.
3. Remove their access in the tools themselves. OutboundManager does not manage logins to your other tools.
4. Untick Active on their rep record and re-assign their open replies.
5. If they had the Slack webhook URL for the weekly report, create a new webhook and replace it.

Enrichment

• Set a per-person monthly budget before the team starts using Enrich. It caps what one compromised or careless login can spend.
• Set the workspace budget a little above what you expect to use in a month.
• Check your provider contracts. Some licences restrict storing or moving their data into other tools; ZoomInfo's is one to read.
• Only upload lists you are allowed to process. Uploaded names, companies and LinkedIn URLs are sent to the providers you select.

AI

• If your policy does not allow sending business data to an AI provider, an admin can turn AI off in Settings → AI. Everything else works without it.
• Do not put secrets, prices under negotiation or personal data in the reply guidelines. They are sent with every draft request.
• Treat every AI draft as unreviewed text until a person has read it.

If you suspect a problem

1. Revoke the affected key in the tool. This cuts access immediately, whatever else is true.
2. Create a new key and use Replace key.
3. Change the passwords of the logins involved, and remove any member you do not recognise.
4. Tell us what you saw. The contact is on the Security page.

Note: You are always in control of the keys: revoking a key in your own tool stops OutboundManager's access to it at once, with no action needed from us.