SynPulse runs outbound for its clients from their own mailboxes and LinkedIn accounts, so we protect those accounts and their data the way we would our own: tenant isolation, least-privilege access, encrypted account credentials, authenticated webhooks, rate limits, audit trails, and a person's approval before any message reaches a prospect.
Client teams
Each client's data is kept apart from every other client's. Team members a client invites see only that client's program, and their access can be switched off at any time; access that is removed also reaches work already queued.
Authentication and AI connections
Production authentication uses verified email, PKCE, scoped access tokens, refresh-token rotation, and a resource-bound MCP audience. When a client connects Claude, ChatGPT or another AI client, it works under that person's program scope and cannot send to a prospect: any draft it asks for waits for a person's approval in SynPulse.
Operations
Secrets are supplied at runtime, sensitive values are excluded from client output and logs, dependencies and containers are scanned, and backups are encrypted and periodically restored in a controlled test.
Responsible disclosure
Test only accounts and data you own. Avoid privacy violations, disruption, social engineering, denial of service, and destructive actions. We will acknowledge a valid report, investigate it, and coordinate remediation and disclosure in good faith.