Security at SalesScope

SalesScope holds what a sales team cares about most: its contact lists, its conversations and the mailboxes it sends from. This page explains how we protect them, as of October 2026. Where we haven’t done something yet, such as a formal certification, it says so.

Infrastructure and hosting

The SalesScope app and this website are served by Cloudflare Workers from Cloudflare’s global network. The database and authentication run on Supabase, a managed PostgreSQL platform, in the AWS us-east-1 region in the United States.

• Encryption in transit. Every connection uses HTTPS. Plain HTTP requests are redirected to HTTPS, and responses carry HTTP Strict Transport Security for a year, including subdomains.
• Secrets stay on the server. The database service key and the key that encrypts mailbox credentials are Cloudflare Worker secrets, never part of the code sent to your browser.
• Security headers. Responses tell browsers not to guess content types, not to let other sites frame SalesScope, and to send other sites no more than our origin as the referrer.

How workspaces are kept apart

Every customer’s data lives in a workspace. Every table the app can query has row-level security switched on, and the database’s internal tables are closed to browsers altogether. PostgreSQL checks each row against its policies before returning it, and since the browser talks to the database directly for everyday work, those policies are the boundary itself, not a second line behind the interface.

• Rows can’t point across workspaces. Every reference between rows carries its workspace, and the database refuses one that doesn’t match, even from SalesScope’s own service role, which row-level security does not restrict.
• Roles are enforced by the database. Admins see every pipeline, managers work the team’s, and members work only the leads assigned to them, however they query.
• Mail belongs to the mailbox owner. A synced message is visible to the person who owns the mailbox it arrived in, and to the workspace’s admins.
• Signed-out visitors reach nothing. The anonymous role has no access to any table or view, and an automated test checks this on every change.
• Company switches hold. Switching off deleting or importing is enforced by the database, for admins too, and switching off sending by the server. Switching off exporting removes the Export button and every export is recorded, but people can still read the rows they’re allowed to see, so we call that switch a deterrent and a paper trail, not a lock.

Mailbox connections and credentials

• Encrypted before storage. OAuth tokens and SMTP passwords are encrypted with AES-GCM, using a 256-bit key and a fresh random 96-bit nonce for every secret. The key is kept apart from the database, so a copy of the database alone doesn’t hand over anyone’s mailbox.
• Never in the browser. Encrypted credentials sit in a table with row-level security on and no policies at all: no signed-in user can read it, only the server that sends your mail.
• Consent that can’t be replayed. Connecting a Google or Microsoft mailbox uses PKCE, a single-use state value and a secure, HTTP-only cookie tied to the browser that started it.

The Gmail permissions SalesScope asks for

These are delegated permissions under https://www.googleapis.com/auth/, granted by the person who connects the mailbox. SalesScope doesn’t ask for full mailbox access or permission to modify mail, so it can’t delete, archive or relabel anything. If a permission is unticked on Google’s consent screen, SalesScope names the missing one and doesn’t connect the mailbox half-working. You can revoke access from your Google account at any time. Reading a Gmail mailbox uses a scope Google classes as restricted, and until Google completes its verification of SalesScope, only approved test users can connect Gmail.

The Microsoft permissions SalesScope asks for

Outlook.com (including Hotmail and Live addresses) and Microsoft 365 mailboxes connect through Microsoft’s own sign-in, and SalesScope reaches them through Microsoft Graph.

Sign-in also asks for openid, which gives no access to mail; it tells a personal Outlook.com account from a work one, which decides the mailbox’s sending ceiling. These are delegated permissions, granted by the person who signs in and limited to that person’s own mailbox. SalesScope never asks for application permissions, which would reach every mailbox in an organization. Mail.ReadWrite also allows changes to mail; SalesScope asks for it rather than read-only access because Microsoft Graph saves a draft with nothing less. SalesScope deletes nothing but its own draft, when Microsoft refuses to send it or the send is stopped before it goes, and never moves, changes or deletes any other message. If a grant leaves out a permission SalesScope needs, it names the missing one and doesn’t connect the mailbox half-working. You can revoke access from your Microsoft account at any time, and an administrator can remove it for the whole organization in Microsoft Entra.

SMTP mailboxes

Other providers connect over SMTP, tested with a live handshake before anything is saved. Port 465 is encrypted from the first byte; on any other port the server must offer STARTTLS, or SalesScope refuses to send the password. The connection test dials only mail ports on hosts with public addresses, and it is rate-limited, so it can’t be used to probe private networks.

Accounts and sign-in

• Passwords must be at least 12 characters, enforced by the server as well as the sign-in screen.
• Invitations are for the address they were sent to; an invite link can’t create an account for anyone else.
• Password resets started by an admin go to the teammate’s own inbox and are never shown to the admin.
• Signing out deletes the copy of your sheet and any reminders the app cached in your browser, so your contacts don’t stay on a shared computer.
• Offboarding. Suspending someone blocks their access in the database at once and ends their sessions on every device. Removing someone ends their access to the workspace and can hand their leads, calls, campaigns and mailboxes to a named colleague first.

Application security

• A strict Content Security Policy. Scripts load only from SalesScope’s own origin, connections go only to its API and database, other sites can’t frame it and plugins are blocked.
• No third-party scripts for analytics, advertising or tracking, in the app or on this site.
• Untrusted content stays inert. Merge fields are escaped before they go into an email, scripts are stripped from stored email bodies before display, and CSV exports neutralize cells a spreadsheet would run as formulas.
• Links go where the email said. Click tracking redirects only to a link that was in the email as sent.
• Rate limits apply to redeeming invitations, connecting SMTP mailboxes, checking addresses and sending from the dialer.

Testing every change

Every pull request and every merge to the main branch runs our checks in CI: type checking and a build, a scan for leaked secrets, dependency audits, about 90 test suites that drive the real app and server code, and a database job that builds a fresh database from the full migration history and tests row-level security and permissions for admins, managers, members, suspended users and outsiders. Workspace isolation, mailbox ownership, invitations, offboarding and the OAuth flow have tests of their own.

Sending safety

A tool that sends email can harm the people who receive it and the domains it sends from. These protections are on in every workspace:

• Addresses are checked before bulk sends. A campaign or sequence refuses to enroll or send to addresses nobody has checked.
• A bounce circuit breaker. When a mailbox’s bounce rate passes the company’s limit (5% by default, judged after 50 sends), the mailbox is held, its sequences pause and its owner is emailed.
• Opt-outs are honored. Every campaign email carries an unsubscribe link and one-click unsubscribe headers (RFC 8058). An unsubscribe, or a reply asking to be removed, stops that person at every address and in every sequence in the workspace.
• Volume stays inside provider limits. New mailboxes warm up gradually, automated sending stops short of each provider’s daily ceiling, and a trial mailbox sends at most 100 emails a day.

Our acceptable use policy sets out what may not be sent through SalesScope. To report spam or misuse, write to abuse@salesscope.io.

Payments

Payments are handled by Stripe. Checkout and the billing portal are Stripe’s own pages, so card details go straight to Stripe and never reach SalesScope’s servers. We keep your plan, seat count and Stripe’s reference numbers. Notifications from Stripe are accepted only with a valid signature and a recent timestamp.

Subprocessors

A few companies help run SalesScope: Cloudflare for hosting and the network, Supabase for the database and authentication, Resend for transactional email such as invitations, and Google and Microsoft for access to the Gmail, Google Workspace, Outlook.com and Microsoft 365 mailboxes you connect. Stripe handles payments as an independent controller. Address checks ask public DNS resolvers, including Cloudflare’s and Google’s, about domain names only. The subprocessor list is the current, complete record.

Privacy

SalesScope sets no analytics or advertising cookies. The app keeps your sign-in session and preferences in your browser’s local storage, and caches sheet rows on your device so it opens quickly. The privacy policy explains how we handle personal data, the cookie policy covers cookies, and the data processing addendum sets out our commitments for customer data. Privacy questions go to privacy@salesscope.io.

Reporting a vulnerability

If you think you’ve found a security problem, email security@salesscope.io with:

• what you found and where: the URL, screen or API route,
• the steps to reproduce it, with any proof of concept,
• what an attacker could do with it,
• how we can reach you.

Test only against accounts and data you own. Don’t access or change other people’s data, email people who haven’t agreed to it, run denial-of-service or high-volume tests, or try social engineering. Please give us reasonable time to investigate and fix the problem before you disclose it publicly. We’ll acknowledge your report and keep you updated while we work on a fix.

Compliance and certifications

SalesScope doesn’t hold SOC 2, ISO 27001 or any other formal security certification yet, and we won’t imply otherwise. What we offer today is this page, the controls it describes and a data processing addendum, which is part of our Terms of Service; for a countersigned copy, write to legal@salesscope.io.

You remain responsible for the lawfulness of your own outreach. The guide to cold email compliance covers the main rules; it is general information, not legal advice.