Security Practices
Last updated: June 26, 2026
Sales Blitz is built for revenue teams who work with their account and pipeline data every day. We treat your book, your research, and your prospect data with the same care you would.
Compliance Status
| Standard | Status |
|---|---|
| SOC 2 Type II | In Progress |
| GDPR | Compliant |
| CCPA / CPRA | Compliant |
| Penetration Testing | Scheduled |
For security questionnaires, DPA requests, or our SOC 2 readiness letter, contact security@salesblitz.ai.
1. Data Encryption
In Transit
All data transmitted between your browser and Sales Blitz is encrypted using TLS 1.2 or higher. This includes API calls, file uploads, and webhook payloads. We enforce HTTPS across all endpoints with HSTS headers.
At Rest
All data stored in our database (Supabase, powered by AWS) is encrypted at rest using AES-256. This covers user profiles, your book, research data, account and contact records, and connected-account tokens. Backup volumes are encrypted with the same standard.
2. Authentication & Access Control
User authentication is handled by Clerk, an enterprise identity provider. Clerk supports multi-factor authentication (MFA), which we encourage all users to enable. Session tokens are short-lived and rotated automatically.
On the infrastructure side, access to production systems is restricted to the founding team. All API endpoints require authentication. Internal service-to-service communication uses signed API keys with rate limiting and spend controls.
3. Infrastructure
| Component | Provider | Region |
|---|---|---|
| Web Application | Vercel | US (Edge, multi-region) |
| Worker Service | Railway | US-West |
| Database & Storage | Supabase (AWS) | US-East-1 |
| Authentication | Clerk | US |
| Payments | Stripe | US (PCI DSS Level 1) |
All infrastructure providers maintain their own SOC 2 Type II certifications. Supabase is SOC 2 Type II and HIPAA compliant. Vercel is SOC 2 Type II certified. Clerk is SOC 2 Type II certified. Stripe is PCI DSS Level 1 certified.
4. Application Security
- Content Security Policy (CSP): Enforced across all pages with strict source allowlists. Prevents XSS and code injection.
- Security Headers: HSTS, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy (strict-origin-when-cross-origin).
- Rate Limiting: All API endpoints are rate-limited. Webhook endpoints have additional per-key rate limits and spend controls.
- Input Validation: All user inputs are validated and sanitized server-side before processing.
- Dependency Management: Dependencies are monitored for known vulnerabilities. Security patches are applied promptly.
5. AI Data Handling
Building your book and drafting outreach uses AI models for research, enrichment, account grading, entry angles, and message drafting. All AI API calls are made server-side, never from the client browser.
None of your data is used to train AI models. All AI providers are accessed via their commercial APIs, which contractually prohibit using customer data for model training.
- Language models: Generate research, account grading, entry angles, and drafted outreach. Inputs are processed via zero-retention commercial APIs and are not stored by the provider after the response.
- Embeddings: Generate vector representations of research text so the book can be searched. Processed per the provider's enterprise terms.
6. Signal Monitoring & Connected Systems
The signal feed is assembled from public sources and, where you connect them, your own systems.
- Public signals: Job changes, new-in-seat moves, posts, funding, and buying windows are gathered from public sources and third-party data providers, then ranked into your weekly feed. No private account is accessed without your authorization.
- Connected systems (Salesforce, Slack): If you connect your own Salesforce or Slack, we use the access you grant to read account activity and deliver signals into those systems. Access tokens are encrypted at rest and revoked the moment you disconnect.
- Deliverability add-on: When you enable sending, your connected email and LinkedIn accounts authorize us to send outreach and check for replies on your behalf. Tokens are scoped to the minimum permissions needed and stored encrypted (AES-256) per account.
7. Data Retention & Deletion
| Data Type | Retention | Deletion |
|---|---|---|
| Account & profile data | While account is active | 30 days after account deletion |
| Book, research & generated assets | While engagement is active, rebuilt monthly | On-demand via app, or on request |
| Signal feed history | Life of the engagement | On request |
| Outreach & reply content (add-on) | While the add-on is active | On disconnect or account deletion |
| Connected-account tokens (sending, Slack, Salesforce) | While the integration is connected | Deleted on disconnect or account deletion |
| Usage & application logs | 90 days | Automatic rotation |
Users can request a full data export or account deletion at any time by contacting security@salesblitz.ai. Deletion requests are processed within 30 days.
8. Incident Response
We maintain a documented incident response plan covering detection, containment, eradication, recovery, and post-incident review. In the event of a security incident affecting customer data, we will notify affected users within 72 hours per GDPR requirements and applicable state breach notification laws.
To report a security vulnerability, contact security@salesblitz.ai. We take all reports seriously and will acknowledge receipt within 24 hours.
9. Sub-Processors
The following third-party services process data on behalf of Sales Blitz. Each maintains security practices appropriate to its role. A complete sub-processor list with data categories and geographic locations is in our Data Processing Agreement.
| Sub-Processor | Purpose | Data Processed |
|---|---|---|
| Supabase (AWS) | Database & storage | All application data |
| Anthropic | AI research, grading & drafting | Company/contact info, research context, prompts |
| Embeddings for search | Research text for vector search | |
| Clerk | Authentication | Email, name, auth credentials |
| Stripe | Payment processing | Payment method, billing info |
| Vercel | Application hosting | HTTP requests, session data |
| Railway | Worker service hosting | Processing queues, API calls |
| Resend | Transactional email | Email addresses, notification content |
| Web research provider | Public web research | Search queries (company/industry terms) |
| Data enrichment provider | Contact & company enrichment | Company/contact lookup queries |
| Signal data providers | Public buying-signal monitoring | Account/person identifiers, public events |
| Email delivery provider (add-on) | Sending outreach for customers on the add-on | Prospect emails, campaign metadata, delivery events |
| LinkedIn delivery provider (add-on) | Running LinkedIn steps for customers on the add-on | Prospect profile identifiers, message content |
| Cloudflare | DNS & DDoS protection | Domain routing, traffic analytics |
10. Business Continuity
Database backups run automatically via Supabase's managed backup infrastructure (daily point-in-time recovery, 7-day retention). Application code is version-controlled in GitHub with branch protection. Deployments are automated via CI/CD with rollback capability.
11. Employee Security
Sales Blitz is currently a founder-led company. Access to production systems, databases, and third-party service consoles is limited to the founder. As the team grows, we will implement role-based access controls, background checks for all employees with production access, and mandatory security awareness training.
Questions?
For security inquiries, DPA requests, or to submit a completed security questionnaire, contact security@salesblitz.ai.