Your accounts and data, handled with care.
Outember holds sign-ins to the LinkedIn accounts and mailboxes you trust it with. Here's exactly how we protect them, written from the code, including what we don't do yet.
We keep as few secrets as we can, and lock up the rest.
The fewer passwords we hold, the less there is to lose.
We never see your LinkedIn password
You sign in to LinkedIn on our provider Unipile's hosted page, including two-step verification. Only a connection to the account comes back to us.
Secrets sealed with AES-256-GCM
Mailbox passwords, Google and Microsoft sign-in tokens, CRM tokens, webhook signing secrets and Slack webhook URLs are encrypted with AES-256-GCM, using a key derived from a server secret, before they're stored. The API never sends them back.
Passwords hashed with scrypt
Your account password is stored only as a scrypt hash. Signing in takes the same time whether or not an email exists, and sign-in and sign-up are rate-limited.
One-time links
Email verification and password-reset links are single-use, stored only as hashes, and expire after 48 hours and 1 hour. A password reset signs you out everywhere.
Everyone sees only what they should.
Every request is checked against your workspace and your role, on the server.
Role-based access
Owners, admins, members and view-only viewers. Only the owner changes the plan and payment details; only owners and admins manage the team, integrations and API keys. Roles are checked on every request.
Workspaces kept apart
Each request resolves its workspace from your membership, and every database query is filtered by that workspace. One client's leads and conversations never show up in another's.
Sessions and API keys stored as hashes
Your session cookie holds a random token (HttpOnly, sent only over HTTPS); we store only its SHA-256 hash. API keys are shown once and stored as hashes too, act as a member (never an admin), and stop working within a minute of being revoked.
Staff access is limited and recorded
Our team's admin tools need a staff role and two-factor authentication, checked on every request. Every staff action, such as suspending an account or opening a short support session in a customer's account (one hour at most), is written to an audit log.
Data that leaves, leaves signed.
Webhooks, automation tools and providers' notifications are verified both ways.
Signed outbound webhooks
Every delivery carries an HMAC-SHA256 signature with a timestamp, so your server can check it came from us and reject replays. In production, endpoints must use https and public addresses, and redirects aren't followed.
Verified inbound events
Events from our LinkedIn provider are checked against a shared secret, stored once with a unique key, then processed. Stripe's billing events are checked against Stripe's signature.
Rate limits
Requests are rate-limited per session, per API key and per address, with tighter limits on sign-in, sign-up, password resets and the contact form.
Monitoring
Health checks watch the API, database, queues and workers (see our status page), and errors are reported to our error tracker so we can fix them quickly.
Yours to take, yours to delete.
Disconnect and delete
Disconnecting a LinkedIn account also disconnects it from our provider. Removing a mailbox deletes its saved sign-in straight away. Ask us to delete your organization and it's removed within 30 days (backups within 90).
Export any time
Leads, campaign results, the do-not-contact list and monthly reports download as CSV from the app.
No selling, no training
We don't sell personal data, show ads, or train AI models on your leads or messages.
What we don't have yet
Said plainly, so you can judge before you buy.
- No third-party certification (such as SOC 2 or ISO 27001) yet.
- No two-factor sign-in or single sign-on (SSO) for the app yet.
- No dedicated IP address per LinkedIn account.
Found a vulnerability? Tell us first.
Email security@outember.io with what you found and how to reproduce it. We aim to acknowledge your report within two business days and keep you updated while we fix it.
security@outember.ioPlease
- Give us a reasonable time to fix the issue before you share it with anyone else.
- Only test against your own account and data. Don't access, change or delete other people's data.
- No denial-of-service, spam, social engineering or physical attacks, and no automated scanning that degrades the service.
- Stop and tell us as soon as you've shown the problem exists.
If you act in good faith and follow these rules, we won't take legal action against you for your research, and we'll credit you if you'd like.
Can your team read my messages?
What happens to my mailbox password?
Is my LinkedIn account safe with you?
How do I report a security issue?
Need it in writing? Ask for our DPA.
For the leads and messages in your account, you're the controller and we're your processor. We'll send the data processing addendum ready to sign.