Trust and security

Each client gets its own EmailBison and HeyReach workspace, so sending accounts, campaigns, sequences, and replies are not mixed across clients at the sending layer. Campaign activity, suppression records, and billing are recorded against the client they belong to.

Business contact records that we source ourselves are held in one shared database. We keep it shared so that we can avoid contacting the same person from several campaigns and can honor an opt-out everywhere. Client-supplied data is handled under our Data Processing Addendum.

Credentials live in a secrets manager and in per-client encrypted configuration, never in source control. Automated checks block secrets and pipeline data from being committed to our repositories. Changes to security-sensitive code and rules require review by an administrator before they merge.

Database access is tiered by role and enforced with row-level security. Finance and billing data is restricted to administrators. Contact records enter our database only through a server-side function that applies our verification and do-not-contact checks.

Do-not-contact and opt-out lists are enforced on the server before any contact is added to a campaign, and email addresses are verified before sending. Opt-outs are kept on a suppression list so they continue to hold after an engagement ends.

If we confirm a security incident that affects a client's data, we notify that client without undue delay and no later than 72 hours after confirmation. Operational alerts are monitored through our internal alerting channels.

Clients and the individuals we contact can ask us to access, correct, or delete personal information by emailing rees@astragtm.io. Client deletion and return terms are set out in our Data Processing Addendum.

Astra GTM does not currently hold a SOC 2 or ISO 27001 certification. We answer security questionnaires and sign a Data Processing Addendum on request, and will go through your vendor review process.