Security Overview

Platform architecture

The application is a Next.js frontend hosted on Vercel, backed by Convex for the database and backend functions, with Clerk as the identity provider. Every request passes through four authorization layers before it can touch organization data:

• Edge middleware: session propagation, security headers, content security policy, and IP-based rate limiting before the request reaches application code.
• Identity validation: sessions are short-lived JWTs issued by Clerk and validated server-side on every backend call.
• Backend authorization: every backend function derives the caller's organization and role on the server and enforces org-scoped access.
• Per-record ownership verification: organization-owned records are checked against the caller's server-derived organization after fetch, so a valid session in one tenant can never read another tenant's records.

Identity and access control

• Role model: three tiers (internal staff, customer admin, customer rep) with role checks performed exclusively on the server. Frontend role claims are treated as display hints, never as authorization.
• Role drift detection: if a session token's role ever diverges from the database role, the discrepancy is logged and the database remains authoritative. High-impact role overrides via session claims are blocked outright in production.
• Enterprise SSO: SAML and OIDC enterprise connections (including Okta Workforce) are supported through the identity layer, so your IdP's authentication and MFA policies govern access.
• Brute-force protection: credential attempts are handled at the identity provider boundary, with endpoint rate limits and configurable account lockout.

Multi-tenant isolation

Broken object-level authorization is the most common failure mode in multi-tenant SaaS, so we treat it as a first-class engineering problem rather than a code-review checklist item.

• Every fetch of an organization-owned record verifies the record's actual organization against the caller's server-derived organization. Failures return a generic not-found so record existence is never leaked across tenants.
• Static authorization scanners run in continuous integration against every publicly callable backend function and require zero violations before code can merge.
• A dedicated cross-organization mismatch scanner catches handlers that accept a client-supplied organization identifier instead of deriving it from the authenticated session.

Encryption and secrets

• In transit: all traffic is encrypted with TLS, and HSTS is enforced with preload.
• OAuth tokens: access and refresh tokens for connected mailboxes and calendars are encrypted with AES-256-GCM before they are written to the database, decrypted only in memory at the moment of an API call, and their access is audit-logged.
• API keys: stored as hashes only; plaintext keys are never persisted after creation, and key creation, rotation, and revocation are audit-logged.
• Application secrets: injected through environment configuration and never committed to source control, with a build-time guard that fails deployments missing required production auth configuration.

Application security

• Security headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, restrictive Referrer-Policy and Permissions-Policy, and cross-origin isolation headers on every response.
• Input validation: schema validation at every API boundary, plus transport-level argument validation on backend functions where unexpected fields are rejected automatically.
• SSRF protection: outbound requests derived from user-controlled URLs pass an allowlist guard that blocks private IP ranges.
• Error sanitization: production error responses strip stack traces, internal paths, and database details, and an automated scanner enforces zero information leakage.
• Webhook security: inbound webhooks are HMAC signature-verified with timestamp checks, and processed through atomic idempotency reservations retained for 30 days.

AI guardrails

Revogent drafts outreach with AI, but it does not send with AI. Control over what actually leaves your organization stays with your people.

• Human approval gate: every AI-drafted outbound message lands in a review state, and a person explicitly approves each message before it can send.
• Kill switches: outbound communications and AI generation can each be paused platform-wide instantly, and outbound can also be paused for individual users.
• Automatic protective pauses: sequences pause automatically on bounces, out-of-office replies, and complaint signals, and require human review to resume.

Monitoring, audit, and operations

• Audit logging: a structured, organization-scoped audit log records sign-in events, permission denials, role changes, OAuth connections and disconnections, token refresh failures, data exports and deletions, admin access, webhook signature failures, and rate-limit violations.
• Error monitoring: errors are captured by our self-hosted error tracker, with personal data scrubbed before an event is stored. Error reports are never sent to a third-party monitoring vendor.
• Rate limiting: three layers of enforcement, and security-boundary rate policies fail closed in production if the limiter infrastructure is unavailable.

Security testing and review

• Dedicated security test suite: more than 40 specialized test files covering authorization scanning, negative-path authentication, multi-tenant isolation, webhook contracts, and adversarial role-gating, run in continuous integration.
• Adversarial review: high-impact authentication flows (OAuth callbacks, webhook handlers, admin endpoints) receive adversarial review before merge that deliberately attempts bypass, injection, and cross-organization access.
• Recurring hardening: a scheduled review pass covers new backend functions, API routes, and webhook endpoints added since the previous pass.
• Dependency security: dependency audits gate merges, and moderate-or-higher severity vulnerabilities must be resolved before code ships.

Vulnerability disclosure

We appreciate coordinated disclosure. Report suspected vulnerabilities with reproduction details and we will respond promptly, keep you informed through remediation, and credit researchers who wish to be credited.