Defense-in-depth technical controls, encryption standards, and responsible disclosure
Last Audited: August 2026
Encryption at Rest
Connected email passwords, OAuth tokens, and sensitive integration keys are protected using AES-256-GCM authenticated encryption before database storage.
Secure Session Design
Session tokens are isolated from browser JavaScript using strictly scoped HttpOnly cookies and verified using cryptographic CSRF validation tokens.
Ephemeral Memory Processing
Credentials are only decrypted in transient volatile memory during active outbound dispatch cycles and purged immediately upon socket completion.
1. Cryptographic Protection & Key Management
Sales Morgan applies authenticated symmetric cryptography to protect connected credentials and tokens:
Symmetric Encryption at Rest: All stored SMTP passwords, Microsoft Graph API tokens, and Meta access tokens are encrypted using AES-256-GCM (Galois/Counter Mode) with unique initialization vectors and authentication tags to guarantee both confidentiality and integrity.
Decoupled Key Management: Master encryption keys are stored separately from the database in isolated server environment variables and are never checked into source code repositories.
Transport Security: All web traffic and API communications are encrypted in transit using TLS 1.3 with strict HTTP Strict Transport Security (HSTS) preloading.
2. Authentication & Browser Security Standards
To protect customer accounts against Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF):
HttpOnly Session Cookies: Access and refresh tokens are stored in browser cookies marked with HttpOnly, Secure, and SameSite=Lax attributes. Authentication tokens cannot be read or stolen by third-party browser scripts.
Re-Authentication for Sensitive Actions: Generating new developer API keys or modifying sensitive workspace credentials requires explicit password confirmation to prevent unauthorized access.
Smart Abuse & Rate Protection: Multi-tiered rate limiters and Cloudflare Turnstile protect accounts against brute-force password guessing and automated spam.
Zero Device Hardware Access: Strict browser permissions policies guarantee that Sales Morgan never accesses your device camera, microphone, or geographic location.
Cryptographic CSRF Tokens: Every state-changing API request requires an independent CSRF header verified against a secure hash embedded within the session.
3. Official Platform Authorization (Meta & LinkedIn)
Sales Morgan connects with external platforms exclusively through official authentication dialogs (Meta Graph API and LinkedIn OpenID Connect). We do not store raw social passwords, inject browser cookies, or employ unofficial scraping bots. Inbound webhook events and profile tokens are cryptographically verified in real time.
Sales Morgan maintains a documented Security Incident Response Plan. While no software platform can promise absolute invulnerability, we maintain continuous monitoring, defense-in-depth controls, and structured response procedures:
Our technical operations team initiates immediate containment and isolation procedures upon detecting anomalous activity.
In the event of a verified Personal Data Breach affecting customer data, affected customers and relevant supervisory data protection authorities will be formally notified within seventy-two (72) hours of confirmation, pursuant to GDPR Article 33.
Notifications provide an assessment of impacted records, actions taken, and recommended remedial measures.
5. Responsible Vulnerability Disclosure Program
We welcome reports from independent security researchers and ethical security professionals. If you believe you have discovered a vulnerability in our application, API, or infrastructure, please follow our responsible disclosure guidelines:
Do not access, download, modify, or delete data belonging to other accounts or users.
Do not execute Denial of Service (DoS/DDoS) attacks, automated high-volume fuzzing, or physical social engineering attacks.
Allow our security team reasonable time (at least 30 days) to investigate and deploy remediation before publicly disclosing technical details.
Safe Harbor: Sales Morgan will not pursue legal action against security researchers who identify and report vulnerabilities in good faith in accordance with this policy.
Initial Acknowledgement:Within 24 business hours of receipt.
Triage & Status Update:Within 5 business days with remediation status.
