Security architecture
Your data is isolated, encrypted, and governed.
SalesLobe processes sensitive sales conversations. We take that seriously. This page describes exactly how your data is protected: no compliance badges we haven't earned, no vague promises.
Six pillars
Security by architecture, not by promise
These are not aspirational goals. They are how SalesLobe works today, enforced at the infrastructure level.
Row-level security
Every workspace is isolated at the database level using Supabase RLS policies. Queries are scoped to the authenticated user's workspace, cross-tenant access is blocked at the database layer.
Encryption everywhere
All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 via Supabase. SalesLobe API keys are stored only as hashes, and your own AI and provider keys are stored encrypted in Supabase Vault.
Client data isolation
Agency workspaces and their clients are strictly isolated. A client's reply content, tone guides, and campaign data cannot be accessed by another client, even within the same agency account.
Bring Your Own Key
Every plan, trial included, lets you provide your own Anthropic API key. Your key is stored encrypted in Supabase Vault and used only for your workspace's AI processing. Full control over your AI pipeline.
EU data residency
Your workspace data is stored in the EU: AWS eu-north-1 (Stockholm) via Supabase, which holds a SOC 2 Type II report. AI inference, billing and error monitoring run through sub-processors, partly in the US under SCCs or the EU-US Data Privacy Framework.
AI processing without training
Anthropic does not train on your data; Corty's learning stays inside your workspace. Anthropic does not train on API data and deletes it within its standard API retention period. With BYOK, requests run under your own agreement with Anthropic. Inbox email content can be auto-deleted after a retention period you set per workspace.
Data flow
What happens to a reply
From the moment a reply enters SalesLobe to the moment it's stored, every step is isolated and encrypted.
Reply arrives
A reply arrives from Smartlead or Instantly (webhooks plus a sync) or through the Make/BCC loop (managed inboxes). The raw reply enters your isolated workspace.
Classified & isolated
Corty labels the reply hot, warm, cold or not interested within your workspace's RLS boundary. No data crosses tenant boundaries.
AI drafts a response
Reply content is sent to Anthropic Claude for drafting. Anthropic does not train on your data; retention follows Anthropic's API policy (or your own agreement under BYOK).
Encrypted at rest
The draft, classification, and all metadata are stored encrypted at rest and isolated per workspace by row-level security.
Data residency
Where your data lives
Infrastructure
Built on trusted platforms
We don't run our own data centers. We build on platforms that have earned their compliance certifications so we can focus on application-level security.
Supabase and Vercel certifications are maintained by those platforms independently. SalesLobe's security benefits from their certified infrastructure.
Subprocessors
Who touches your data
One central list shows every sub-processor, what data it handles, where it is processed and under which transfer mechanism, plus the optional services you connect yourself.
View the sub-processor listNew sub-processors are announced at least 30 days in advance.
GDPR Art. 28
Data Processing Agreement
Your agency is the controller, SalesLobe processes reply data on your behalf. Request our DPA and we send it to you for signing, so you can show your clients how their lead data is handled.
On compliance certifications
We do not currently hold SOC 2, ISO 27001, or HIPAA certifications. We are actively building toward SOC 2 Type II. We will not display compliance badges until we hold the actual certifications: that's a deliberate choice, not an oversight.
If your organization requires specific compliance documentation, we're happy to discuss your requirements. Contact sales@saleslobe.com
Responsible disclosure
Found a security vulnerability? We take every report seriously.
Your data, your control
Every feature in SalesLobe is designed so you stay in control of your data.
Questions about security?
We're happy to walk through our architecture in detail. No sales pitch required.