Security Overview
Last updated July 21, 2026
This document describes current baseline technical and organizational measures for RevenueCallout. It is not a certification, penetration-test report, guarantee of absolute security, or commitment to a specific service level unless incorporated into a signed agreement.
Current controls
Tenant isolation. Customer records carry a tenant identifier and database row-level security restricts authenticated access. Server integrations must resolve tenant identity from trusted records rather than webhook payload claims.
Access and authentication. Supabase authentication protects user sessions. Owner-only functions control billing and sensitive workspace settings. Service credentials remain server-side and are not intentionally exposed to browsers.
Encryption. Production web traffic uses TLS. Hosting and database providers manage encryption for stored infrastructure data according to their platform controls.
Application security. API input and file checks, rate limits, authorization gates, tenant scoping, security headers, signed or secret-authenticated webhooks, and replay/idempotency controls reduce common abuse paths.
Resilient processing. Webhook work uses a durable database queue with bounded retries, exponential backoff, deduplication, and dead-letter status rather than relying only on one serverless request.
Logging and monitoring. Structured operational events, request identifiers, error monitoring, health checks, and scheduled diagnostics support detection and investigation. Logs are designed to avoid raw transcripts and secrets.
Development controls. Changes are version controlled and tested through automated unit, security, AI-contract, build, dependency-audit, secret-scan, and end-to-end checks before release.
Vendor controls. Production providers are inventoried on the Subprocessor List. Customer-directed integrations can be disabled and access tokens should be limited to required scopes.
Continuity and deletion. Managed hosting and database infrastructure provide platform recovery capabilities. Durable jobs preserve pending work across serverless restarts. Customer-content deletion remains subject to backup cycles and legal retention.
Shared customer responsibilities
- use unique credentials, protect email accounts, and promptly remove former users;
- grant only needed CRM, meeting, and billing permissions;
- obtain recording consent and avoid prohibited or unnecessary sensitive data;
- review AI Outputs and restrict exports to authorized recipients;
- keep source devices, meeting platforms, and connected systems secure; and
- report suspected incidents promptly.
Reporting a vulnerability or incident
Send a concise description, affected URL, reproduction steps, and contact information to hello@revenuecallout.com. Do not access other users' data, disrupt production, use automated high-volume testing, or publicly disclose an unresolved issue. We will acknowledge and triage good-faith reports.