Your business context. Your decisions.

The short version

Your roles run on our servers on a schedule. To do the work, they process the data you connect: the CRM records, emails, and calendar you link, plus the context you provide. That data is encrypted, isolated to your account, used only to produce your drafts and reports, never sold, and never used to train models. Everything is draft-first: nothing reaches a person without your approval. Below is exactly how we secure it, who we share data with, and the controls you have.

How your data is handled

Because the work runs on our servers, we process the data a scheduled run needs to produce your drafts and rollups. We are deliberate about what we keep and how it is protected.

• What we process: the tools you connect (CRM records, email, calendar) and the company context you provide, read by a run to research an account and draft the work.
• What the first launch reads, writes and sends: it reads your public website and web search results to draft the brief and the market research; it writes companies and contacts to your workspace and, if you connect Attio, to your CRM; it places drafts in your Gmail when you connect it with draft permission; it sends nothing. Contact enrichment through your own Apollo account runs only when you turn it on.
• What we store: the drafts and reports we generate for you (these contain content, and live in your account until you dismiss them), plus run telemetry that is metadata only (counts, skill names, outcomes, timing, error categories).
• What we never do: we do not sell your data, share it with advertisers, or use it to train models. You connect each tool with your own permission and can revoke it at any time.
• Isolation: every record is keyed to your account or team, and every query is scoped to the authenticated session, so one tenant cannot read another's data.
• Credential custody, your choice: with managed connectors we custody your OAuth token encrypted and revocable; with the self-hosted lane (your own n8n) we never hold your credentials at all, the connectors run on your infrastructure and we only receive the drafts you send back. The self-hosted lane is the enterprise choice when you cannot let a vendor hold a token.

You can export or delete your data at any time (see below), and revoking a connected tool stops any further processing of it.

Security practices

• Encryption in transit and at rest. All traffic is HTTPS. OAuth tokens are encrypted at rest with AES-256-GCM. The database is encrypted at rest by our provider.
• Sessions. Server-side sessions with an opaque, random id in an HttpOnly, SameSite=Lax, Secure cookie. Revoking a session deletes one row, no token lives in the browser.
• API keys. The Sales as Code keys your integrations authenticate with are stored only as a SHA-256 hash, are scoped, and are rate-limited per key. Every control-plane call is logged.
• Your AI provider key. Your scheduled runs happen with no browser open, so the provider key they run on is held on our servers rather than in your browser: encrypted at rest with AES-256-GCM under a key derived from our session secret, never read back to a browser, never logged, and used only to make your own runs. Inference is billed to you by your provider. Replace or delete it at any time from your console's Settings tab, and deleting your account deletes it with everything else.
• Tenant isolation. Every record (runs, entitlements, keys, brain state) is keyed to your account or team, and every control-plane query is scoped to the authenticated session before it reads. One tenant cannot see another tenant's data; team-scoped views are additionally limited to the members of that team.
• Single sign-on (SAML). Teams can route sign-in through their own identity provider with just-in-time provisioning and group-to-role mapping. See /login/sso.
• Audit log. Every admin-relevant action is written to an append-only audit log. You can retrieve your own entries (the actions you took, and the actions taken on your account) as JSON from /api/me/audit. Entries are never edited in place; they are retained for 18 months and then pruned. A team-scoped view and CSV export for team admins is on the roadmap and is not available today.
• You control publishing. Your roles are tool-agnostic and draft-first: by default they draft and stage for your review. They publish automatically only on channels you connect and explicitly enable for automation, and only after a brand-safety check; anything that reaches a person, or any channel where automation is disallowed, is always held for your approval. You set the mode per channel and can revert to draft-only at any time.
• You choose where output goes. Each role's output lands where you pick: an in-app draft queue, your Google Drive, or your own mailbox as a draft. Nothing is sent for you.

Compliance posture & SOC 2 roadmap

We want to be straight with you about where we are. Sales as Code is an actively developed product. We follow the security practices above as a matter of course, but we do not yet hold a SOC 2 or ISO 27001 certification: treat SOC 2 as on the roadmap, not as something we've achieved. We won't imply a certification we don't have. If your procurement process requires a specific certification, a data processing agreement (DPA), a security questionnaire, or a penetration-test summary: the DPA is published and already in force, the questionnaire is answered below, and for anything else contact us and we'll tell you honestly what we can provide today and what's planned.

The security questionnaire, already answered

Rather than ask you to send a spreadsheet, here are the 21 questions a security review asks, answered. Every answer states what is true today. Three of them are no, and they are at the top rather than buried, because those are the ones that end a procurement conversation and you should find them before you spend a week on us.

Need it on your own form, or a countersigned DPA? Email admin@salesascode.com and quote this page. If your process requires a certification we do not hold, say so before you buy rather than after.

Subprocessors

We use the following vendors to run the service. We don't sell your data or share it with advertisers. Several are conditional. They only process your data when you connect or enable the feature that uses them. This list is kept in sync with the privacy policy from one shared registry.

Where your data lives

Primary database: Neon (Postgres), U.S. region. Application servers: Vercel, distributed globally with U.S. compute. If you're outside the U.S., your data is processed in the U.S.

AI inference is yours, not ours. You supply the provider key (Anthropic, OpenAI, OpenRouter or Amazon Bedrock) and your prompts go to the provider you chose, under your contract with them and their region and retention terms, not ours. We custody the key encrypted and call the endpoint on your schedule. This page used to name Anthropic here as though the choice were ours, which under bring-your-own-key it is not.

Your data and retention

• Access. Everything the control plane holds about you is visible in the product.
• Export. Download all of your data as JSON at any time from Settings → Data, or export your synced brain, see how export works.
• Delete. Request account deletion from Settings → Data. We hard-delete within 7 days. Stripe retains billing records per its own policy for tax and accounting.
• Disconnect. Revoke any connected tool (CRM, inbox, calendar) at any time to stop processing it. Any API key you issued for advanced access can be revoked from Settings → Advanced.

Reporting a vulnerability

If you find a security issue, email admin@salesascode.com with the details and steps to reproduce. We'll acknowledge and work the fix. Please don't publicly disclose until we've had a chance to remediate. (Our contact page also lists security@salesascode.com for responsible-disclosure reports. Both addresses route to the same inbox, so use whichever you find first.)

Questions

For DPAs, security questionnaires, or anything not covered here, reach us at our contact page or admin@salesascode.com. See also our Privacy Policy and Terms.