Security & data ownership

1. The data is yours, not ours

• Leads, contacts, correspondence, quotes, orders and knowledge base you import or create are yours.
• We do not use your customer data for our own business development, and we do not share it with any third party, including other tenants.
• We do not train models on your data. Only what is needed for the task at hand is sent to the model provider.
• The same applies to our affiliates — the company behind this platform also does export trade, so "affiliates may not use customer data" is written into the terms of service, not just promised verbally.

2. Accounts are isolated at the database level

The classic multi-tenant accident is a missing WHERE clause that returns someone else’s data. We do not rely on application code getting it right every time; isolation is enforced inside the database:

• PostgreSQL Row Level Security: 85 of 101 business tables have it enabled. Policies filter rows in the database, so even a wrong query cannot reach another account.
• The application connects as an ordinary role, never a superuser — superusers bypass every row policy, so we cut that path off at the connection.
• Every new table must ship with a tenant column, a foreign key and an isolation policy. That is a hard internal rule.

3. Whether our people can get in

Support occasionally needs to enter your account to diagnose something. There is no back door; it is a flow that requires your approval:

• A platform admin must request access and state a reason. Your owner account approves it.
• Approval is time-boxed and expires automatically. You can revoke it at any moment.
• Every access during that window is logged — when, and which page or endpoint. You can read the log yourself under Settings → Data Access.
• You may also switch on pre-approved access. That is your choice, not the default — the default is that we ask.

4. Where it lives and how it is protected

• Servers are in Singapore; all traffic is encrypted over HTTPS.
• Passwords are stored as salted bcrypt hashes. We cannot see your password; it can be reset, never read.
• Third-party credentials you connect (mailbox authorisations, API keys) are encrypted at rest (AES with HMAC verification), never stored in plain text.
• Sessions are validated server-side and expire after 7 days; unusual access stays in the audit log.
• The database is backed up daily, 31 copies retained. A backup nobody has restored is not a backup — we run restore drills to confirm it really rebuilds a working database.

5. Take it away or delete it, any time

• One-click full export: a zip with one CSV per table, opens straight in Excel. No limits, no request form, no need to talk to us.
• Account deletion: self-service, with a 7-day grace period (the account keeps working and you can cancel). After that everything under the account is erased.
• No "contact sales to export" barrier — whether you can leave should not depend on how much we want you to stay.

6. What we do not do

• We do not email your customers on your behalf without your knowledge. Automation is off by default, the switch is in settings, and when it is on the list shows a permanent marker.
• We never put your customers into any shared pool. The shared buyer pool is built from public sources and is entirely separate from your private leads.
• We do not "delete" by hiding. After deletion the rows are gone, not flagged.

7. What we have not done yet

This section exists because a security page listing only strengths is not believable. Honestly, as of today:

• No two-factor authentication yet — email and password, with rate limiting on login.
• No third-party security audit or certification (SOC 2, ISO 27001) yet.
• Single-server deployment with no hot standby. Backups live in off-site object storage, but recovering from a full host failure needs manual work.
• If your industry requires any of the above, tell us now — we will say plainly whether we can meet it, rather than signing first and explaining later.

8. Questions

For anything about security or your data, write to kevin@reachoai.com and our technical lead will answer. If you find a vulnerability, please report it to the same address — we will fix it and tell you the outcome.