Security overview
How your API keys and data are protected, what OutboundManager can and cannot do in your tools, and an honest list of what is not in place yet.
For: Admins, IT and security reviewers
OutboundManager holds API keys to your sales tools and the data those tools return. This page explains the protections in plain terms for someone deciding whether to connect a tool. The formal statement is the Security page.
What OutboundManager can do in your tools
It reads. It does not run outreach, create campaigns or change records. There are exactly two things it can write, and both happen only because someone on your team chose them:
- A reply that a person writes in the reply queue and sends by pressing Send. It goes out through the tool that received the original reply.
- Four attribution properties on HubSpot deals, if an admin turns write-back on. It is off by default.
You control the ceiling yourself: a key without write scopes cannot write. See the minimum scopes in API keys by tool.
How keys are protected
A key is pasted once into this form, checked, and stored encrypted. It is not shown again. Demo data.
- Keys, tokens and Slack webhook URLs are encrypted with AES-256-GCM before they are stored.
- A key is used only on our servers, to call the tool it belongs to. It is never sent back to the browser, never shown again after saving, and never written to logs or error messages.
- Only workspace admins can add, replace or remove keys. Managers and reps cannot see or change them.
- Removing a connection deletes its key.
Keeping workspaces and people apart
- Every database query is limited to one workspace. Automated tests check that one workspace cannot read another's data through any query or endpoint.
- Inside a workspace, a rep can only read their own data. This is enforced in the data queries on the server, not by hiding buttons. The same tests check rep against rep.
- A page or record someone may not see answers "not found", so its existence is not revealed.
Sign-in
- Passwords are hashed with scrypt and a per-user salt. The password itself is never stored.
- Passwords must be at least 10 characters and cannot be your email address.
- Failed sign-ins are limited to 5 per email address and 20 per IP address in 15 minutes.
- The session is a signed, HTTP-only, secure cookie that expires after 30 days.
- All traffic uses HTTPS.
Where it runs
The application is hosted on Vercel and the database on Neon, both in the United States. The service is operated from India. The full list of providers is on Sub-processors.
AI
AI requests go to Anthropic only when someone uses an AI feature. Prompts are built from a fixed list of fields; keys and secrets are never included, and the reply draft feature never sends email addresses, phone numbers or LinkedIn URLs. An admin can turn AI off for the workspace. The exact data per feature is in AI features.
Our own access
Our internal admin panel shows account-level information: plans, connection status and usage counts. It does not display keys, reply text, contacts or deal names. It is limited to named staff accounts, and every change made from it to a workspace's plan or settings is recorded in an audit log.
What is not in place today
We would rather you know this before you connect than find out in a review.
| Not available yet | What to do meanwhile |
|---|---|
| Two-factor authentication | Use a long, unique password from a password manager for each login. |
| Single sign-on (SAML or OIDC) | Keep the member list short and remove leavers promptly in Settings → Team. |
| Self-serve password reset by email | A signed-in person can change their password under Account. If someone is locked out, an admin contacts us. |
| A customer-facing audit log of member actions | Reply assignments show who assigned and when. For anything else, ask us. |
| An independent security audit report or certification | We answer security questionnaires. Email the address on the Security page. |
Reporting a problem
If you think a key has leaked, replace it in the tool first, then in Settings → Connections, then tell us. To report a vulnerability, follow Security: reporting a vulnerability.
Something unclear or out of date? Tell us and we will fix this page.