Your pipeline is your business.

Your workspace is isolated at the database level

Every workspace lives behind PostgreSQL row-level security. Isolation is enforced by the database itself on every query, not by application code remembering to filter. Another customer's request cannot return your rows.

Team access is role-based (owner / member), and profile and billing records can only be changed through audited database functions, never by direct writes from a browser session.

We can't look inside your workspace unless you let us in

There is no master key and no admin view of your records. For a support engineer to see your workspace, an Admin has to open a window from Settings and choose how long it lasts. No window, no access — there is no override, and asking you is the override.

A session lasts at most an hour however long you granted, ends the instant you revoke it, and cannot send email from your mailbox or export your data — both are refused for its whole duration. Every entry and exit is written into your own audit log, under the name of the person who came in, where you can read it without asking us for it.

Mailbox connections take the minimum, keep nothing readable

Connecting Microsoft 365 requests only the scopes outreach needs: sending mail, and reading mail so a reply lands on the record it answers. We deliberately do not request read/WRITE — nothing we hold, and nothing anyone who compromised us held, could modify, move or delete a message in your mailbox. Read access is real access, and that is the honest description of it: a compromise of our refresh tokens would be a disclosure of mail in connected mailboxes.

OAuth tokens are encrypted at rest with a key that lives outside the database. Disconnecting a mailbox removes access immediately, and a teammate leaving the workspace revokes their mailbox connection with them.

Your data is yours — provably

Any member can export any list as CSV. A workspace owner can export everything — every table, with IDs and relationships intact, re-importable here or anywhere else. Credentials and tokens are excluded from exports by construction: the export code works from an explicit column whitelist, so a secret can't leak into a zip by accident.

There's no exit tax and no 'talk to us to get your data.' When a trial ends, nothing is deleted; the workspace just locks until an Admin subscribes.

Who we build on

IronVail runs on a small, named set of subprocessors: Supabase (database and authentication), Vercel (hosting), Stripe (billing — card numbers never touch our servers), Resend (transactional email), and Sentry (error diagnostics). Each is listed in our privacy policy with what they process.

Honest limits

We're a young product and we won't pretend otherwise: we don't yet hold a SOC 2 or ISO 27001 certification. What we can show today is architecture (database-enforced isolation, minimal scopes, encrypted secrets, whitelisted exports) and a support team that answers. If your security review needs specifics, ask us anything via the in-app support widget.