Security at Netounim
Sales data is the most lucrative target on your network. We build like everyone is trying to take it — encryption, isolation and audit are not afterthoughts here, they’re the foundation.
What we mean when we say we take security seriously.
Encryption everywhere
TLS (HTTPS) on every endpoint — the web app, the API and the extension. The most sensitive data at rest is encrypted with AES-256-GCM: 2FA secrets, connected-mailbox credentials, SSO configs and DKIM private keys. Each uses a separate key, so compromising one never unlocks the others. Keys are injected at runtime, never committed to the codebase.
Hardened, managed infrastructure
Netounim runs on managed cloud infrastructure — Vercel for the web app, Railway for the API, PostgreSQL and Redis — behind Cloudflare for DDoS protection and a web application firewall. HTTPS is forced with HSTS, and a strict Content-Security-Policy ships on every response. The complete vendor list is in the sub-processors table below.
Least privilege, by default
Inside a workspace, every action is gated by a role (Owner / Admin / Member) and re-checked server-side — the UI can never grant access the API would refuse. Each user only sees their own connected inbox. API keys are scoped to a single workspace, and platform-level admin access is limited to an explicit allow-list and fully audited.
Built for audit
Every sensitive action — sign-ins, 2FA changes, API keys, billing and admin actions — is written to an append-only audit log that workspace owners can read in-app. The same trail is included in the GDPR data export you can download at any time.
How we handle your data and privacy.
We're an early-stage company and aren't SOC 2 or ISO 27001 certified yet — we'll pursue formal third-party audits as we grow. In the meantime our day-to-day practices already line up with the common controls you'd expect (see Engineering practices below), and we're glad to walk a security team through any of them. Email [email protected] for a DPA or to set up a security review.
If you find a bug that could harm our users — tell us first.
In scope
- app.netounim.com and api.netounim.com
- Chrome / Firefox / Edge extension
- Authentication, billing and tenancy isolation
- Server-side template injection, SSRF, IDOR
Out of scope
- Rate-limit / volumetric DoS — please don't test in production
- Self-XSS, clickjacking on no-auth pages, missing CSP nice-to-haves
- Email spoofing without an authentication bypass
- Third-party services on our sub-processors' own domains
Good-faith research that follows this policy will not result in legal action. We will not pursue civil or criminal claims, and we will defend you publicly if a third party tries to.
- Acknowledgement2-3 business days
We confirm we received your report and start looking into it. We read security@ ourselves — there is no outsourced triage desk.
- Severity assessmentafter triage
We reproduce the issue, gauge its impact, and tell you honestly whether it is in scope and roughly when we expect to fix it.
- Remediationas fast as we can
Fixes ship as soon as they are ready. Genuinely critical issues jump the queue and go out the same day.
- Coordinated disclosureafter the fix
Once the fix is live, we are happy to credit you publicly — with your consent.
What happens if something does go wrong.
Detect
- 1Error monitoring and alerting surface anomalies in production.
- 2Reports sent to security@ skip the queue and are read directly by the team.
- 3We confirm or rule out a real incident as quickly as we can.
Contain
- 1Affected credentials and encryption keys are rotated.
- 2Compromised components are isolated from production.
- 3Stopping the spread comes before anything else.
Notify
- 1Confirmed personal-data breaches: affected customers notified within 72 hours, per GDPR Art. 33.
- 2A written post-mortem with timeline, root cause and corrective actions once the dust settles.
- 3A direct contact for any follow-up questions.
Every vendor that could touch your data, listed here.
Required under GDPR Art. 28. We give workspace admins 30 days’ notice before adding a new sub-processor — subscribe to sub-processor change notifications to be alerted automatically.
| Sub-processor | Purpose | Region | DPA signed |
|---|---|---|---|
| Vercel | Web app hosting + CDN | US / global edge | Yes |
| Railway | API, PostgreSQL database, Redis | US | Yes |
| Cloudflare | DNS, CDN, DDoS protection, WAF | Global | Yes |
| Stripe | Billing + payment processing | US / EU | Yes |
| Postmark | Transactional + campaign email delivery | US | Yes |
| Apollo | Contact + company data enrichment | US | Yes |
| People Data Labs | Phone / contact enrichment | US | Yes |
| Twilio | Phone number validation (Lookup) | US | Yes |
| Bouncer | Email verification | EU | Yes |
| OpenAI | AI drafting (only when you use it) | US | Yes |
| Sentry | Error monitoring (optional) | US | Yes |
| Google Analytics | Web analytics (only with consent) | US | Yes |
The boring guardrails that keep code shipping safely.
Version control + CI gates
Every change goes through a pull request and continuous integration before it ships: type-checking and the full automated test suite run on each push, dependencies are watched for known vulnerabilities, and we run a secret-scan over the codebase before each release.
Tenant isolation, by design
Every database query is scoped by workspaceId at the application layer — applied consistently across the API and covered by tests, so there is no path that returns another workspace's rows.
Continuous testing
Over 650 automated tests run in CI on every push — covering authentication, two-factor, role-based access control, billing webhooks and the deliverability logic. We'll add external penetration testing as we grow.
Secret hygiene
Production secrets are injected at runtime as environment configuration — never committed to the repository and never written to logs. Encryption keys are split by concern so each can be rotated independently.
Need to fill out a security questionnaire?
Send yours over and we’ll work through it with you — we usually reply within a couple of business days. We’re glad to share a security overview, sign a DPA, and walk your team through any specific control.