Tenant isolation
Every record is scoped to a workspace derived from your signed-in session, never from the request. Cross-workspace access is covered by automated tests.
Security and privacy by design
How the product is built today. We don't hold security certifications yet and won't claim any until audited.
Sessions and MFA
Secure, HTTP-only session cookies with CSRF protection, rate-limited sign-in and authenticator-app MFA.
Least privilege
Roles with explicit permissions. A workspace admin is not a platform-wide reader.
Secrets stay server-side
Provider tokens and API keys are encrypted at rest, never sent to browsers and shown only once when created.
Signed webhooks
Inbound events are signature-checked, de-duplicated and replay-protected before anything is processed.
Audit trail
Exports, configuration, knowledge publication, sends, consent and overrides are recorded.
Export and deletion
Admins can delete a customer's data and export a workspace (export is in private beta), with the action audited.
AI safety rails
Tools are allowlisted and permission-scoped. Text in messages, images or web pages cannot authorise actions.
Report a vulnerability
Email security@stayreplied.com. Please don't test against other customers' data.
Stop losing customers to slow replies.
Create your workspace today: 14-day free trial, no card needed.