Security
You're handing over client API keys. Here's how we keep them safe.
Your whole business rides on other people's workspaces — so ColdOps treats every key like a production secret. Each claim below describes how the product actually works, not a compliance poster.
What we do with your keys — and what we can't do.
API keys handled like passwords
Every key is validated live against the provider when you paste it, encrypted with AES-256-GCM before it touches the database, and never displayed again — the UI only ever shows the last four characters. Disconnect a workspace and the ciphertext is destroyed with it.
AES-256-GCM at rest · last-4 display only
Read-only by design
Syncs only read campaign, mailbox, and warmup data. ColdOps never sends an email from your accounts and never touches your sequences. The one exception is auto-fix: reversible pause rules that are off by default, opt-in per issue type, and logged.
Never sends · pauses are opt-in + reversible
Per-agency isolation
Every row in the database carries your agency's ID, and Postgres row-level security checks membership on every query. One agency can never read another's data — the database itself refuses.
Postgres RLS enforced on every domain table
Metrics, not lead PII
We store campaign metrics — sends, replies, bounces, health scores — and your own mailbox addresses. Your prospects' names, emails, and conversations stay in your sending platform; ColdOps never pulls them.
Aggregate counts and rates, not contact lists
Payments handled by Stripe
Checkout and billing run entirely on Stripe. Card numbers go straight to Stripe and never touch ColdOps servers — we store only your plan and subscription status.
Card data: Stripe only, never ColdOps
Encrypted in transit
Everything is served over HTTPS with HSTS preload, so browsers refuse to downgrade the connection. A strict Content-Security-Policy locks scripts and outbound connections to known origins, cutting off the classic exfiltration paths.
TLS everywhere · HSTS preload · strict CSP
Questions about security? Email mcharradi@coldops.io — you'll get an answer from the person who wrote the code.