Security at ReachOut

Access and tenant boundaries

• Organization-scoped authorization is enforced for customer data and worker operations.
• Role-based permissions separate members, administrators, owners, and platform root users.
• API keys are scoped, revocable, and stored as hashes rather than recoverable plaintext.
• Administrative actions and worker activity are exposed through audit and operational views.

Infrastructure and data protection

• TLS protects public application, API, tracking, and database connections in transit.
• Production services and workers use separate credentials and explicit deployment targets.
• Database backups, incremental changes, and write-ahead logs support point-in-time recovery.
• Secrets are supplied at deployment time and are not intended to be committed to source control.

Application safeguards

ReachOut validates inbound tracking and worker payloads, applies rate and usage controls, and keeps organization context attached to background work. Email delivery, analytics ingestion, and AI insight generation are separated into independently deployable workers so each workload can be observed and scaled without granting it broader access than it needs.

Responsible disclosure

If you believe you have found a vulnerability, emailhello@usereachout.com with enough detail for us to reproduce it. Please avoid accessing other users' data, disrupting the service, or publishing details before we have had a reasonable opportunity to investigate.