// Security

Security & data protection.

How we protect your account, your keys, and your data — in plain terms.

How we protect your data

Encrypted in transit

All traffic to the app and its APIs is served over HTTPS/TLS. Nothing moves in the clear.

Encrypted at rest

Connected API keys and OAuth tokens are encrypted at rest with AES-256-GCM before they're stored.

Hardened passwords

Passwords are stored only as salted, memory-hard scrypt hashes with constant-time verification — never in plain text.

Workspace isolation

Multi-tenant with row-level scoping: one workspace can't see another's leads, settings, keys, or inbox.

Your keys stay yours

Whether you use platform keys or bring your own (on Scale & Agency), connected keys and tokens are encrypted at rest, used only to run your jobs, and never exposed to prospects.

Least-privilege access

Session-based logins with role gating — tenant-admin controls are separated from platform-only controls.

Payments handled by Stripe

We never see or store full card numbers. Billing runs on signature-verified, idempotent Stripe webhooks.

Spend safety rails

Per-workspace budgets and a hard monthly cap pause AI automatically before spend can run away.

Transparent sub-processors

We name every third party that touches your data in our Privacy Notice, and we don't sell data.

Responsible disclosure

We welcome reports from security researchers. If you believe you've found a vulnerability in StellarReach, please email support@stellarreach.app with the details and steps to reproduce. We'll acknowledge your report, keep you updated, and work to resolve confirmed issues promptly.

Please act in good faith: give us a reasonable chance to fix the issue before any public disclosure, avoid accessing or modifying data that isn't yours, and don't run tests that could degrade the service for others (for example, denial-of-service or large-scale automated scanning).

Shared responsibility

Security is a partnership. We protect the platform; you help by using a strong, unique password, keeping your connected accounts and API keys secure, limiting who can access your workspace, and making sure your outreach complies with applicable law. See our Terms of Service and Privacy Notice for the full picture.

Questions about security?

We're glad to walk through how StellarReach handles your data.