How we protect your data.

The short version

Your products run on our servers on a schedule. To do the work, they process the data you connect: the CRM records, emails, and calendar you link, plus the context you provide. That data is encrypted, isolated to your account, used only to produce your drafts and reports, never sold, and never used to train models. Everything is draft-first: nothing reaches a person without your approval. Below is exactly how we secure it, who we share data with, and the controls you have.

How your data is handled

Because the work runs on our servers, we process the data a scheduled run needs to produce your drafts and rollups. We are deliberate about what we keep and how it is protected.

• What we process: the tools you connect (CRM records, email, calendar) and the company context you provide, read by a run to research an account and draft the work.
• What we store: the drafts and reports we generate for you (these contain content, and live in your account until you dismiss them), plus run telemetry that is metadata only (counts, skill names, outcomes, timing, error categories).
• What we never do: we do not sell your data, share it with advertisers, or use it to train models. You connect each tool with your own permission and can revoke it at any time.
• Isolation: every record is keyed to your account or team, and every query is scoped to the authenticated session, so one tenant cannot read another's data.
• Credential custody, your choice: with managed connectors we custody your OAuth token encrypted and revocable; with the self-hosted lane (your own n8n) we never hold your credentials at all, the connectors run on your infrastructure and we only receive the drafts you send back. The self-hosted lane is the enterprise choice when you cannot let a vendor hold a token.

You can export or delete your data at any time (see below), and revoking a connected tool stops any further processing of it.

Security practices

• Encryption in transit and at rest. All traffic is HTTPS. OAuth tokens are encrypted at rest with AES-256-GCM. The database is encrypted at rest by our provider.
• Sessions. Server-side sessions with an opaque, random id in an HttpOnly, SameSite=Lax, Secure cookie. Revoking a session deletes one row, no token lives in the browser.
• API keys. The Sales as Code keys your integrations authenticate with are stored only as a SHA-256 hash, are scoped, and are rate-limited per key. Every control-plane call is logged.
• Tenant isolation. Every record (runs, entitlements, keys, brain state) is keyed to your account or team, and every control-plane query is scoped to the authenticated session before it reads. One tenant cannot see another tenant's data; team-scoped views are additionally limited to the members of that team.
• Single sign-on (SAML). Teams can route sign-in through their own identity provider with just-in-time provisioning and group-to-role mapping. See /login/sso.
• Audit log. Every admin-relevant action is written to an append-only audit log. You can retrieve your own entries (the actions you took, and the actions taken on your account) as JSON from /api/me/audit. Entries are never edited in place; they are retained for 18 months and then pruned. A team-scoped view and CSV export for team admins is on the roadmap and is not available today.
• You control publishing. Your products are tool-agnostic and draft-first: by default they draft and stage for your review. They publish automatically only on channels you connect and explicitly enable for automation, and only after a brand-safety check; anything that reaches a person, or any channel where automation is disallowed, is always held for your approval. You set the mode per channel and can revert to draft-only at any time.
• You choose where output goes. Each product's output lands where you pick: an in-app draft queue, your Google Drive, or your own mailbox as a draft. Nothing is sent for you.

Compliance posture & SOC 2 roadmap

We want to be straight with you about where we are. Sales as Code is an actively developed product. We follow the security practices above as a matter of course, but we do not yet hold a SOC 2 or ISO 27001 certification: treat SOC 2 as on the roadmap, not as something we've achieved. We won't imply a certification we don't have. If your procurement process requires a specific certification, a data processing agreement (DPA), a security questionnaire, or a penetration-test summary, contact us and we'll tell you honestly what we can provide today and what's planned.

Subprocessors

We use the following vendors to run the service. We don't sell your data or share it with advertisers. Several are conditional. They only process your data when you connect or enable the feature that uses them. This list is kept in sync with the privacy policy from one shared registry.

Where your data lives

Primary database: Neon (Postgres), U.S. region. Application servers: Vercel, distributed globally with U.S. compute. AI inference: Anthropic, U.S. region. If you're outside the U.S., your data is processed in the U.S.

Your data and retention

• Access. Everything the control plane holds about you is visible in the product.
• Export. Download all of your data as JSON at any time from Settings → Data, or export your synced brain, see how export works.
• Delete. Request account deletion from Settings → Data. We hard-delete within 7 days. Stripe retains billing records per its own policy for tax and accounting.
• Disconnect. Revoke any connected tool (CRM, inbox, calendar) at any time to stop processing it. Any API key you issued for advanced access can be revoked from Settings → Advanced.

Reporting a vulnerability

If you find a security issue, email admin@salesascode.com with the details and steps to reproduce. We'll acknowledge and work the fix. Please don't publicly disclose until we've had a chance to remediate. (Our contact page also lists security@salesascode.com for responsible-disclosure reports. Both addresses route to the same inbox, so use whichever you find first.)

Questions

For DPAs, security questionnaires, or anything not covered here, reach us at our contact page or admin@salesascode.com. See also our Privacy Policy and Terms.