Security

Effective: October 6, 2026 · Version 2026-10-06-draft-1

In short

Your data is kept separate from every other customer's, access inside your workspace follows roles, traffic is encrypted, and incoming webhooks are verified. This page lists only controls we operate today.

What we do today

  • Encryption in transit: connections to BrandTitan and between our services and providers use HTTPS/TLS.
  • Tenant isolation: row-level security is enabled on our database tables, so each customer's records are scoped to their own company; stored files such as call recordings and lead uploads are kept in private, company-scoped storage.
  • Role-based access: workspace members have roles (such as owner, admin, and viewer) that decide what they can see and change.
  • Signed webhooks: incoming webhooks from our payment, messaging, email, and advertising providers are verified by signature and rejected if the signature is missing or wrong.
  • Secrets handling: telephony credentials are stored in a managed secrets vault rather than in application tables.
  • Human approval for risky ad changes: large or irreversible advertising changes require approval by an owner or admin before they are made.
  • Backups: our database is backed up daily by our hosting provider.
  • Audit logging: team actions in a workspace are logged.
  • Opt-out handling: STOP and unsubscribe requests are honored.

Where we are headed

We are continuing to strengthen our program. Certifications such as SOC 2 are not held today.

[JAMES: confirm before publishing whether to state that SOC 2 readiness is on the roadmap. Do not add any certification, MFA, penetration-test, or encryption-at-rest claim until it is verified.]

Report a vulnerability

If you believe you have found a security issue, email [SECURITY CONTACT EMAIL] with the details and how to reproduce it. Please do not access other customers' data, disrupt the service, or publicly disclose the issue until we have had a reasonable time to fix it. We will acknowledge good-faith reports and will not pursue action against researchers who follow these rules.

[JAMES: provide the security contact address, then publish it in /.well-known/security.txt (none exists yet). Counsel to confirm the safe-harbor wording.]

More

See our Data Processing Addendum, the list of sub-processors, and our Privacy Policy.