Security
You're handing over client API keys. Here's how we keep them safe.
Your whole business rides on other people's workspaces — so Coldops treats every key like a production secret. Each claim below describes how the product actually works, not a compliance poster.
What we do with your keys — and what we can't do.
API keys handled like passwords
Every key is validated live against the provider when you paste it, encrypted with AES-256-GCM before it touches the database and never displayed again — the UI only ever shows the last four characters. Disconnect a workspace and the ciphertext is destroyed with it.
AES-256-GCM at rest · last-4 display only
Read-only by design
Syncs only read campaign, mailbox and warmup data. Coldops never sends an email from your accounts and never touches your sequences. The one exception is automations: pause rules that are off by default, opt-in per issue type and logged — confirmed on Instantly and Smartlead, attempted on EmailBison. Apollo connections are read-only end to end.
Never sends · pauses are opt-in + logged
Per-agency isolation
Every row in the database carries your agency's ID. Every query is scoped to it in application code, and Postgres row-level security enforces membership underneath as a second line of defence. One agency can never read another's data.
Org-scoped queries · Postgres RLS on every domain table
Metrics, not lead PII
We store campaign metrics — sends, replies, bounces, health scores — and your own mailbox addresses. One check reads lead data and does not keep it: the provider-mix check samples recipient domains and discards the addresses. No prospect name, address or reply body is ever written to our database.
Recipient domains only, never a stored address
Payments handled by Stripe
Checkout and billing run entirely on Stripe. Card numbers go straight to Stripe and never touch Coldops servers — we store only your plan and subscription status.
Card data: Stripe only, never Coldops
Encrypted in transit
Everything is served over HTTPS with HSTS preload, so browsers refuse to downgrade the connection. A strict Content-Security-Policy locks scripts and outbound connections to known origins, cutting off the classic exfiltration paths.
TLS everywhere · HSTS preload · strict CSP
Questions about security? Email mcharradi@coldops.io — you'll get an answer from the person who wrote the code.