Guarding Every Asset
SendCopy is a cloud-based LinkedIn outreach platform. Every campaign, lead list, LinkedIn credential, and inbox conversation is something our customers trust us with.
Trust & Infrastructure
Security at SendCopy
How we protect your data, your campaigns, and your LinkedIn accounts with bank-grade security protocols.
Updated June 2026 | Safe & Secure Infrastructure
Our Philosophy
Our Approach to
Reviewed by Design
Security is an engineering principle, not a compliance exercise. Every feature is reviewed for security implications before shipping. Every third-party service is assessed for data protections.
Reporting Vulnerabilities & Inquiries:
[email protected]Hosting & Resilience
Infrastructure &
| ITEM | DETAIL | NOTES |
|---|---|---|
| Cloud provider | Amazon Web Services (AWS) | All infrastructure runs on AWS |
| Uptime target | 99.9% monthly | Monitored continuously at status.sendcopy.ai |
| Data redundancy | Multi-AZ replication | Replicated across multiple Availability Zones |
| Backups | Daily, automated | Point-in-time recovery, encrypted, tested quarterly |
| Backup retention | 30 days | Automatic deletion after 30 days |
| Disaster recovery | RTO: 4 hours, RPO: 1 hour | Tested twice per year |
Cryptography Standards
Encryption &
All data is encrypted in transit and at rest — not optional, applies to every single account connected to SendCopy.
| WHAT IS ENCRYPTED | STANDARD | DETAIL |
|---|---|---|
| Data in transit | TLS 1.2 min / TLS 1.3 preferred | SSL, TLS 1.0, TLS 1.1 disabled |
| Data at rest | AES-256 | Campaigns, lead lists, account data, inbox content |
| LinkedIn credentials | AES-256 with envelope encryption | Separate key per account via AWS KMS |
| Database encryption | AES-256 | All databases and backups encrypted |
| Passwords | bcrypt with salt | Never stored in plain text |
| Key management | AWS KMS | Automatic rotation policies |
Security Boundaries
Access
Access restricted to the absolute minimum required. No unrestricted internal access. All operational access is logged.
| CONTROL | HOW IT WORKS |
|---|---|
| MFA | Available for all accounts, required for internal team |
| RBAC | Need-to-know basis for engineers, support, operations |
| Privileged access | Restricted to named individuals, all sessions logged |
| Access reviews | Quarterly reviews, immediate revocation on offboarding |
| SSO | Google Workspace for team; SAML 2.0 for enterprise customers |
| Session management | Expiry on inactivity, tokens rotated on login |
| Password policy | Min 12 chars, complexity enforced, last 10 reuse blocked |
Development & Code
Application
Secure Development Lifecycle
- Security requirements defined at the start of every single feature.
- All engineers complete rigorous security training on joining and annually.
- Every line of code is peer-reviewed by a second engineer before merging.
- Dependencies are scanned for vulnerabilities automatically on every deployment.
- Static Application Security Testing (SAST) runs on every code commit.
Authentication Security
- Passwords hashed using bcrypt with a unique, cryptographically strong salt.
- Account lockout activated after 5 failed authentication attempts.
- Password reset tokens expire after 30 minutes and are single-use.
- MFA available for all, mandated for elevated database access.
- OAuth 2.0 protocols for LinkedIn connections — we never ask for your LinkedIn password.
API Security
- All API endpoints require cryptographically signed authentication.
- Rate limiting enforced strictly on all public and private endpoints.
- API keys hashed in storage, shown only once at creation time.
- All requests logged with timestamp, endpoint, and user context.
- Strict input validation and sanitization on all endpoints.
Vulnerability Verification
Security
| TEST TYPE | FREQUENCY | DETAIL |
|---|---|---|
| External penetration test | Annual | Independent third-party, critical findings remediated within 30 days |
| Vulnerability scanning | Weekly automated | All production systems, triaged and tracked |
| Dependency scanning | On every deployment | Automated tooling for known vulnerabilities |
| Static code analysis (SAST) | On every commit | Identifies patterns before production |
| Security code reviews | On high-risk changes | Manual review by senior engineer for auth, data access, encryption |
| Bug bounty | Planned | Responsible disclosure programs |
Penetration test summaries are available on request. Full reports can be disclosed under NDA for enterprise-tier partners.
Tenant Isolation
Data Handling &
7.1 Tenant Isolation
- All database queries are scoped strictly to the authenticated account ID.
- No API path can return another customer's data under any condition.
- Logically isolated at both the application and database layers.
- LinkedIn credentials encrypted with a unique, per-account KMS key.
7.2 Data Minimisation
- We only collect metadata required to operate the automation platform.
- We never sell, rent, or trade customer data under any circumstances.
- We never use campaign or prospect data to train machine learning models without consent.
- System analytics anonymised at collection point where possible.
7.3 Data Deletion
- Delete your account and all associated campaign data from settings anytime.
- Personal data removed from primary systems within 30 days of deletion.
- Anonymised aggregate metrics may be retained for general performance stats.
- Backup copies automatically purged and overwritten on the next rotation cycle.
Contingency & SLAs
Incident Response
| STAGE | WHAT HAPPENS |
|---|---|
| Detection | Automated monitoring and alerting, routed immediately to on-call engineer. |
| Classification | Severity P1-P4 based on data impact, availability, and exposure. |
| Containment | Isolation and mitigation triggered within 1 hour for P1 incidents. |
| Investigation | Root cause analysis compiled within 72 hours of incident resolution. |
| Customer notification | Prompt notification sent within 72 hours per GDPR Article 33 guidelines. |
| Regulator notification | Filing completed within 72 hours for EU/UK personal data breaches. |
| Post-incident review | Conducted for all P1/P2 incidents; remediation points tracked to closure. |
Employee Security
- Security training completed before any production access is granted.
- Mandatory annual security awareness training for all staff.
- Background checks required for personnel with production or customer data access.
- Least privilege access boundaries, reviewed and recertified quarterly.
- All logical access revoked within 24 hours of employee departure.
- Company-managed devices with enforced full disk encryption and MDM.
- Strict clean desk and clean screen policies enforced globally.
Third-Party Security
Every third-party vendor is assessed thoroughly before onboarding and reviewed annually. Our vendor assessment covers:
- Data Processing Agreement (DPA) fully executed before sharing any operational data.
- Thorough review of the vendor's SOC 2 Type II or ISO 27001 reports.
- Verification of data residency and valid international transfer safeguards.
- Strict evaluation of incident response plans and breach notification SLAs.
Standards & Frameworks
Compliance &
| FRAMEWORK | STATUS | NOTES |
|---|---|---|
| GDPR | In place | Full documentation at sendcopy.ai/legal/gdpr-compliance, DPAs available |
| UK PECR | In place | Cookie consent and electronic marketing compliance |
| CCPA | In place | Do Not Sell Personal Information link in website footer |
| SOC 2 Type II | Planned | Interim security controls documented and provided on request |
| ISO 27001 | Planned | Controls aligned strictly with Annex A implemented |
| ePrivacy Directive | In place | Prior consent protocols and clear 'Reject All' options integrated |
Security Partnership
Shared Responsibility
SendCopy is responsible for:
- Platform, core infrastructure, and application security mechanisms.
- Encrypting customer data strictly in transit and at rest.
- Access controls and rigorous internal authentication protocols.
- Detecting, containing, and responding to security incidents.
- System patching, upgrades, and vulnerability remediation.
- Physical security of hosting centers (managed via AWS).
You are responsible for:
- Keeping account credentials, passwords, and sessions secure.
- Enabling multi-factor authentication (MFA) across your team.
- Configuring appropriate internal team access levels and roles.
- Promptly revoking access for departed or offboarded team members.
- Adhering to local GDPR and data protection compliance rules.
- Securing devices used to access the SendCopy application.
Policy Governance
Disclosures &
Updates to This Page
We modify this documentation when operational, technical, or statutory requirements change. Significant modifications will trigger email alerts to all administrators. Current version is live at sendcopy.ai/legal/security.
Security Contacts
- Vulnerability reports: [email protected]
- General questions: [email protected]
- Enterprise reviews: [email protected]
Average response time: 5 business days