Product
How we handle the data, and what we have not certified yet.
Written for the person who has to sign off before a campaign buys anything — with the gaps stated rather than glossed.
Data handling
- In transit: TLS on every connection, including webhook delivery to your endpoints. We will not deliver to a plain HTTP endpoint.
- At rest: encrypted storage for supporter records, delivery logs and backups.
- Secrets: destination credentials are encrypted with restricted access and are never rendered back into the UI after entry.
- Webhook integrity: HMAC-SHA256 over the raw body, plus a timestamp header. Verification samples for Node, Python and PHP are in the docs.
- Access control: role-based, least privilege, logged. Each customer is a separate workspace and nothing crosses between them.
- Ad destinations: email and phone are SHA-256 hashed to each platform's specification before they leave our infrastructure.
Retention and deletion
Supporter data is retained on the schedule you configure. On your instruction, or at the end of the agreement, we delete from live systems on a defined schedule and from backups as the backup cycle expires. Delivery logs are retained on a shorter schedule than the records themselves.
What we cannot do: delete data already written into your own destination systems. That is a controller-side obligation, and our documentation names the exact field to filter on so it is a query rather than an archaeology project.
Consent as a technical control
The consent gate is a stage in the pipeline, not a policy. There is no configuration that disables it, no enterprise override, and no per-jurisdiction exception. See platform for where it sits and consent-first for why.
What we have not certified
We do not hold SOC 2 today. We are stating that plainly rather than displaying a badge for an audit that is in progress, because "SOC 2 in progress" on a marketing page has become close to meaningless. The controls above are in place now. The certification is on the roadmap, and this section will be rewritten on the day a report is issued.
Sub-processors
Current categories and purposes. Named providers are listed in the executable DPA and in the customer dashboard; changes are notified in advance with an opportunity to object.
| Category | Purpose | Location |
|---|---|---|
| Cloud hosting & edge delivery | Serving the application and the tag | United States |
| Managed database & object storage | Supporter records and delivery logs | United States |
| Identity resolution provider | Resolving consented visitors into contact fields | United States |
| Transactional email provider | Product and account email | United States |
| Error monitoring | Application diagnostics; configured to scrub personal data | United States |
Questions people actually ask
Do you have SOC 2?
Not today. We are not going to display a badge we have not earned. The controls described on this page are real and in place; the certification is on the roadmap and this page will change on the day it is issued, not the day the audit starts.
Where is data processed?
In the United States. Sub-processor locations are listed above, and changes are notified in advance under the DPA with an opportunity to object.
How long do you keep supporter data?
Per your configured retention schedule. On instruction or at the end of the agreement, we delete from live systems on a defined schedule and from backups on the backup expiry cycle. We cannot delete what has already been written into your own CRM — that is your controller-side action.
How is the webhook secured?
HMAC-SHA256 over the raw request body in a signature header, plus a timestamp header to defeat replay. Verify both in constant time before trusting a payload.
Who on your team can see supporter data?
Access is role-based and limited to personnel who need it for support and operations, all bound by confidentiality. Access is logged.
What happens in a breach?
We notify affected controllers without undue delay after becoming aware, with the information available at the time and updates as the investigation proceeds. The commitment is in the DPA, not just on this page.
See what your own website already knows.
Book a 20-minute walkthrough. We will look at your site's current consent posture first — that part is useful whether or not you buy anything.