Security

Our approach

We collect only the data the product needs, keep each customer’s data separate, keep secrets on the server, and write down what we do. We are a small team, so very few people have access to production systems, and code changes are type-checked and built before release.

Data protection

• Encryption in transit: all traffic uses TLS (HTTPS).
• Encryption at rest: data is encrypted at rest by our database provider. HubSpot and Apollo access and refresh tokens are additionally encrypted by Revive Sales (AES-256-GCM) before they are stored, and the encryption key is held separately from the database and supports rotation.
• Passwords are stored only as salted hashes by our authentication provider. We never see or store card numbers; payments are handled by Stripe.
• Tenant isolation: every workspace’s data is separated with row-level security in the database, and server-side checks confirm the workspace behind each request.

Access control

• Server-only secrets: CRM tokens sit in a table that browsers cannot read. Billing and plan fields cannot be changed from a user’s browser.
• Workspace roles: only workspace owners can connect a CRM or invite teammates.
• Production access is limited to authorised personnel. Service credentials are kept in environment secrets, not in code.

Application security

• Safer connections: HubSpot sign-in uses signed, time-limited state so a connection cannot be completed by someone else.
• Abuse protection: sign-in, sign-up and account-lookup endpoints are rate limited, and the account-lookup endpoint validates its input.
• Browser protections: the site sends security headers, including a content security policy that limits where scripts, styles and connections can come from, and blocks framing by other sites.
• Dependencies: we keep the web framework patched and review dependency advisories.
• Audit trail: connecting or disconnecting HubSpot or Apollo, Apollo lookups (without the names or emails involved), closing an account, and billing events are recorded in an internal audit log that records actions, not CRM content.

Deletion and portability

Closing your account deletes your workspace, uploads, accounts, signals, HubSpot and Apollo connections and login, cancels your subscription, and asks HubSpot to revoke our access. Copies in our database provider’s backups are removed when those backups expire. You can export your data through the Service before closing.

What we send to AI and search providers

Your pipeline data is used only to produce your signals and suggested messages. Our AI provider, Anthropic, processes it on our behalf through its business API, and we do not use Customer Data to train AI models. Web searches send company names and short phrases, not your full notes.

Subprocessors

These providers process data on our behalf to run the Service. We will notify customers by email before adding a subprocessor that handles Customer Data.

Availability and backups

The Service runs on Vercel and Supabase, and our database provider maintains backups. We work to keep the Service available but do not currently publish uptime or recovery-time commitments.

Incident response

If we become aware of a breach affecting your data, we will contain it, investigate, and notify affected customers without undue delay with what we know and what you may need to do. We will help you meet your own notification obligations.

Reporting a vulnerability

If you believe you have found a security issue, email support@revivesales.app with the subject “Security” and enough detail to reproduce it. We will acknowledge it, keep you informed, and fix confirmed issues promptly. If you act in good faith — you test only your own account, do not access or change other people’s data, do not degrade the Service, and give us reasonable time to fix the issue before you disclose it — we will not take legal action against you.

Where we stand on compliance

We are not currently SOC 2 certified and have not yet had an independent security assessment. We design to common expectations (encryption, access control, least privilege, deletion on request) and publish our practices here. We act as a processor for your Customer Data and our Data Processing Addendum applies to it. GDPR and CCPA rights are described in our Privacy Policy. We plan to pursue SOC 2 as the business grows.

Your part

Use a strong, unique password; keep your devices and CRM secure; remove people who no longer need access; and tell us promptly at support@revivesales.app if you suspect unauthorised access.