Request a demo
SECURITY

Your sales data stays yours

What we actually do to protect your accounts, your contacts and your conversations.

Scalemerce's database is hosted in the European Union (Supabase, Frankfurt). Each client company has a workspace isolated by database access rules, connections are encrypted, sending mailbox passwords are kept in an encrypted vault, platform administration requires two-factor authentication and sensitive actions are logged.

By Aymen MokademUpdated on

Measures in place

  • Hosting

    Database, authentication and files at Supabase, in the European Union (Frankfurt). Web application at Vercel. Sending server at Oxahost, in Tunis.

  • Workspace isolation

    Each client company has its own workspace. Database access rules (Row Level Security) restrict every query to the data in the user's workspace.

  • Roles

    Owner, admin, sales manager, sales rep and viewer (read-only): each role limits what a user can see and change.

  • Encryption in transit

    All connections use HTTPS (TLS).

  • Protected secrets

    Sending mailbox passwords are encrypted in a vault and are never sent back to the interface. Provider keys stay on our servers.

  • Administration behind two-factor authentication

    The platform administration console requires a session verified with a second factor (TOTP).

  • Audit logging

    Sensitive actions (settings, roles, sends, AI approvals, credits) are recorded in an audit log.

  • AI under control

    AI runs through Anthropic's commercial API. Its drafts are approved by a person before anything is sent.

Sending compliance

  • One-click unsubscribe

    Every prospecting email contains an unsubscribe link and the one-click unsubscribe header.

  • Suppression list

    An unsubscribed address or domain is never contacted again by the company.

  • Country rules

    Email prospecting is blocked for countries where prior consent is required.

  • Informing recipients

    The first email in a sequence states the data source and links to the sender's privacy policy, which is required before any sending.

Subprocessors

Supabase, Vercel, Resend, Apollo, Anthropic, MillionVerifier, Firecrawl and Oxahost. Their role, country and transfer safeguards are detailed in the privacy policy.

For a security question, a vendor audit or a data processing agreement request: hello@scalemerce.com.