Security & compliance

Built for the data your brokerage actually carries.

Workspace isolation at the database level. Role-based access on every endpoint. Signed webhooks, encrypted secrets, and an append-only conversation log so nothing gets lost.

Workspace isolation by construction

Every record — leads, messages, billing rows, audit entries — is scoped to a single workspace. Cross-workspace reads and writes simply are not possible. This is how every well-built SaaS works under the hood, including the ones your CRM runs on.

Authentication & role-based access

Role-based permissions on every endpoint. Tokens scoped to workspace. Session policy and rotation handled centrally. Owner, agent, and read-only access levels are standard; custom roles available for brokerages.

Append-only conversation audit

Every inbound message, every AI response, every workflow execution — written to an append-only log. So when you need to know exactly what was sent and when, the answer is there. Exportable for compliance review on request.

Signed webhooks & observability

HMAC-signed webhook handshakes for every inbound source. Sentry on backend and frontend. Health checks on Twilio, OpenAI, Claude fallback, Calendar, and Stripe — surfaced live in the platform Errors page.

Compliance posture
TCPA-aware messaging
CAN-SPAM compliant
Stripe PCI-DSS
Encrypted at rest & in transit