Security

Last updated 12 October 2026

Some details on this page are being finalised.

API keys and secrets

• API keys, tokens and Slack webhook URLs are encrypted at rest with AES-256-GCM before they are stored.
• Keys are used only by our servers to call the tool they belong to. They are never sent back to the browser, shown again after saving, or written to logs.
• Only workspace admins can add, replace or remove keys. Removing a connection deletes its key.

Workspace isolation and roles

• Every database query is scoped to one workspace. Automated tests check that one workspace cannot read another’s data, and that a rep cannot read another rep’s data inside a workspace.
• Roles (admin, manager, rep) are enforced on the server and in the data queries, not only hidden in the interface. A page someone may not see answers as if it did not exist.
• When a workspace is read-only (for example after a trial ends), syncing, sending, enrichment and AI are blocked on the server, not just in the interface.

Sign-in

• Passwords are hashed with scrypt and a per-user salt; we never store them in plain text.
• Failed sign-ins are rate limited: 5 per email address and 20 per IP address in 15 minutes, after which sign-in is locked for that window.
• Sessions use a signed, HTTP-only, secure cookie that expires after 30 days.

Infrastructure

• All traffic to outboundmanager.app and to the tools we call is encrypted in transit with TLS (HTTPS).
• The application is hosted on Vercel and the database on Neon, both in the United States. See Sub-processors.

AI data minimisation

AI prompts are built from a fixed list of fields, never a whole database record. Secret-looking fields are dropped even if listed, and the reply-draft feature never sends email addresses, phone numbers or LinkedIn URLs. AI can be turned off per workspace. What each feature sends is listed on the Privacy page.

Our own access

Our internal admin panel shows account-level information (plans, connection status, usage counts) and does not display keys or your synced content. It is limited to named staff accounts, and every change made from it to a workspace’s plan or settings is recorded in an audit log.

Certifications

OutboundManager is run by an independent developer and does not hold a SOC 2 report or ISO certification today. If your security review needs more detail, email hello@outboundmanager.app and we will answer your questionnaire.

Reporting a vulnerability

If you find a security issue, please email hello@outboundmanager.app with the steps to reproduce it. Please do not access or change other people’s data, run denial-of-service or automated scanning, or make the issue public before we have fixed it. We will confirm receipt, keep you updated and credit you if you would like. Our security.txt lists the same contact.