Security
Security and control by design
This page describes how the product is built today. We describe real controls rather than badges, and we will update it as the platform evolves.
Controls built into the platform
Tenant-scoped data
Every record belongs to a workspace. API requests are checked against the signed-in user’s workspace, and the workspace context is set on each database request so PostgreSQL row-level security policies apply in addition to application checks.
Role-based access
Owner, admin, manager and sales rep roles determine who can manage users, configure integrations, approve drafts and send.
Encrypted OAuth tokens
Mailbox OAuth tokens are encrypted with AES-256-GCM at the application layer before they are stored. You can disconnect a mailbox at any time.
Audit log
Changes to leads, campaigns, users, conversations and the emergency stop are written to an audit log with the acting user and time.
Suppression and unsubscribe enforcement
Unsubscribed and suppressed addresses are checked before every send, across every campaign — not only when a list is imported.
Human approval before sending
Super Intelligence-generated drafts are suggestions. Messages are queued for sending only after a person in your workspace approves them.
Emergency stop
One control pauses all outbound activity for the workspace, and the action itself is recorded in the audit log.
Source provenance
Each contact records where it came from (CSV import or Hunter.io discovery) and its verification status, so you can answer “where did you get my details?”.
Certifications and compliance
Flacron Lead Agent does not currently hold third-party security certifications such as SOC 2 or ISO 27001. We will not claim one until an audit has been completed. If your organization needs a security questionnaire or details about data handling, contact us and we will answer it accurately.
Your responsibilities as a sender
You decide who to contact and what to send. Make sure your outreach complies with the laws that apply to you and your recipients, such as anti-spam and data protection rules. The product’s approval, suppression and unsubscribe controls are there to help, not to replace your own judgment.
Report a security concern
If you believe you have found a vulnerability, please contact us with the details and we will respond as quickly as we can.
Contact the teamPut one accountable workflow behind your pipeline.
Create a workspace, connect a mailbox and import or discover your first list. Nothing is sent until you approve it.