# Security and trust

> Scalemerce's database is hosted in the European Union (Supabase, Frankfurt). Each client company has a workspace isolated by database access rules, connections are encrypted, sending mailbox passwords are kept in an encrypted vault, platform administration requires two-factor authentication and sensitive actions are logged.

Source: https://www.scalemerce.com/en/security · Updated on 2026-10-19

## Your sales data stays yours

What we actually do to protect your accounts, your contacts and your conversations.

## Measures in place

- **Hosting**: Database, authentication and files at Supabase, in the European Union (Frankfurt). Web application at Vercel. Sending server at Oxahost, in Tunis.
- **Workspace isolation**: Each client company has its own workspace. Database access rules (Row Level Security) restrict every query to the data in the user's workspace.
- **Roles**: Owner, admin, sales manager, sales rep and viewer (read-only): each role limits what a user can see and change.
- **Encryption in transit**: All connections use HTTPS (TLS).
- **Protected secrets**: Sending mailbox passwords are encrypted in a vault and are never sent back to the interface. Provider keys stay on our servers.
- **Administration behind two-factor authentication**: The platform administration console requires a session verified with a second factor (TOTP).
- **Audit logging**: Sensitive actions (settings, roles, sends, AI approvals, credits) are recorded in an audit log.
- **AI under control**: AI runs through Anthropic's commercial API. Its drafts are approved by a person before anything is sent.

## Sending compliance

- **One-click unsubscribe**: Every prospecting email contains an unsubscribe link and the one-click unsubscribe header.
- **Suppression list**: An unsubscribed address or domain is never contacted again by the company.
- **Country rules**: Email prospecting is blocked for countries where prior consent is required.
- **Informing recipients**: The first email in a sequence states the data source and links to the sender's privacy policy, which is required before any sending.

## Subprocessors

Supabase, Vercel, Resend, Apollo, Anthropic, MillionVerifier, Firecrawl and Oxahost. Their role, country and transfer safeguards are detailed in the privacy policy.

For a security question, a vendor audit or a data processing agreement request: hello@scalemerce.com.