Security Overview
This page describes the safeguards in place. No system is unhackable, and we do not claim to be. We describe controls, not guarantees.
This document is a draft written by the platform operator. It is not legal advice and has not been reviewed by a lawyer. Nothing on this page claims that the platform, or any business using it, is legally compliant.
Baselines we work to
Application security follows the OWASP Application Security Verification Standard as its checklist. AI risk follows the NIST AI Risk Management Framework and its Generative AI Profile as guidance. Working to a framework is not certification against it.
Tenant isolation
Every business is a separate tenant. Access is enforced in the database with row-level security and re-checked server-side on every privileged action. Tenant identifiers supplied by the browser are never treated as proof of authorisation.
Authentication and access
Passwords are hashed by the managed auth provider and never stored in plaintext. Sessions expire and can be invalidated. Administrative functionality is separated from customer functionality and gated by a role table, never by a client-side flag.
Secrets
Credentials for AI, email, SMS and payment providers stay server-side. They are never bundled into browser code, placed in URLs, or written to logs. Credentials can be rotated and revoked.
Untrusted input
Web pages, emails, uploaded files, customer messages and API responses are treated as data, never as instructions. Instructions embedded in that content do not override the platform's rules, and the platform will not disclose secrets, prompts or another tenant's data on request.
Payments and credits
Subscription state, plan limits, pricing and credit balances are authoritative on the server only. Payment provider webhooks are signature-verified and processed idempotently so a replayed event cannot grant credits twice.
Auditability
Authentication events, administrative actions, billing and credit movements, campaign launches, exports and deletions are recorded. Logs exclude passwords, tokens, keys and full card data, and are access-controlled.
Failing closed
When the platform cannot verify identity, permission, consent or payment state, it refuses the action and records the event rather than guessing.
Incidents
If a security incident occurs we detect, contain, investigate, preserve evidence, revoke affected credentials, restore secure operation, assess affected data and determine notification obligations. We will not tell customers that no data was affected before an investigation supports that.
Limits
We do not claim to be unbreachable, and we do not hold SOC 2, ISO 27001, PCI DSS or HIPAA attestations. Denial-of-service attacks can affect availability despite mitigation. Report suspected vulnerabilities to the operator. Use the contact details published by the business operating this platform.