Sales Morgan is committed to providing a secure, compliant, and reliable platform for your outbound campaigns. We adhere to industry standards and global regulations.
All outbound emails include physical postal address, company name, and RFC 8058 one-click List-Unsubscribe headers. Footer injection is server-enforced and cannot be removed by users.
Lawful basis processing (legitimate interest for B2B outreach), data subject rights respected, DPA available at /dpa.
Hard bounces automatically suppress recipients. Bounce rate is monitored; accounts exceeding 5% hard bounce rate may be paused to protect deliverability.
Global do-not-contact list enforced at queue population and at individual send time. Users cannot override suppression mechanisms.
All Instagram messaging uses the Official Meta Graph API (v18+). No scraping, browser automation, cookie theft, or unofficial API access is utilized or permitted.
Automated messages are only sent within Meta's 24-hour user interaction window. After 24 hours, only human agents may respond using the HUMAN_AGENT message tag (up to 7 days).
Users who send STOP, UNSUBSCRIBE, CANCEL, or similar keywords are immediately suppressed. A confirmation message is sent and no further automated messages are dispatched.
Daily sending limits per Instagram account are enforced with atomic row-level locking to prevent overages and maintain account health.
All incoming Meta webhooks are verified using HMAC-SHA256 signature validation to ensure authenticity and data integrity.
To keep personal LinkedIn profiles 100% safe and compliant with LinkedIn's Terms of Service, Sales Morgan does not use unauthorized bots or browser extensions. Instead, our AI Copilot creates personalized outreach drafts and organized task lists for you to review and send with one click directly.
Automated outreach and lead responses are available exclusively for verified LinkedIn Company Pages using official platform integration permissions.
Signing in with LinkedIn uses official OpenID Connect authentication to verify your identity without Sales Morgan ever having access to your LinkedIn password.
AES-256-GCM for stored credentials, TLS 1.3 for all data in transit across our internal and external networks.
SMTP passwords, Meta access tokens, and API keys are encrypted at rest using AES-256-GCM with unique per-record initialization vectors.
HTTP-only secure cookies, CSRF token validation, and cryptographically random session tokens are enforced.
Row-level data isolation per user workspace. No cross-tenant data access is possible at the database or application level.
Full support for Right to Access, Rectification, Erasure, Portability, and Restriction of Processing.