Security & data protection
A summary for your security, legal and IT reviewers: what RevOS does with your data, where it runs, the controls in place — and, stated plainly, what is not available yet.
Last updated 20 October 2026
What RevOS does with your data
RevOS qualifies target accounts, drafts outreach, and proposes CRM updates from sales calls. Nothing reaches your CRM or a prospect without passing a policy you set — every CRM write and outbound email goes through one approval engine (auto, notify or approve; the default is approve), and every decision is written to an audit log.
| Data | Where it comes from | Why it is processed |
|---|---|---|
| Company records (name, domain, industry, size, region) | Your CRM, your CSV imports, optional data providers | Qualification and scoring |
| Business contacts (name, title, work email) | Your CRM, your imports | Outreach you approve |
| Call transcripts you upload | Your team | Extracting proposed CRM updates and follow-ups |
| Emails sent and replies received | Your mailbox (Gmail or SMTP/IMAP) | Sequencing, pausing on reply, unsubscribe |
| User accounts (name, work email, role) | Your sign-in provider | Access control |
RevOS does not sell data, build cross-customer datasets, or use customer data to train models.
Hosting and data residency
RevOS ships as a small set of containers — a web front end, an API, a background worker and a PostgreSQL database — with no other runtime dependencies. That is what makes all three options the same product, operated by different people.
| Option | Where data lives | Who operates it | Best for |
|---|---|---|---|
| Self-hosted | Your own cloud account or data centre, any region | You — we provide the containers and support | Strict data-control policies, regulated sectors, on-premise Odoo |
| Managed — EU | An EU region, confirmed per customer | 4Scale Partners | EU and French customers (GDPR) |
| Managed — GCC | A GCC region (for example the UAE or Saudi Arabia), confirmed per customer | 4Scale Partners | UAE, Saudi Arabia, Qatar — in-country residency |
Managed hosting in the EU or the GCC is arranged per customer — write to us with the region you need. The cloud provider, region, backup schedule and maintenance window are set out in your agreement.
What stays in the region
Everything RevOS stores — accounts, contacts, emails, transcripts, CRM sync state, audit log, AI call logs — is in the PostgreSQL database in the chosen region, along with its backups. Data leaves the region only:
- to the AI model provider, for the specific task (the account or transcript text the task needs), and
- to your own connected systems — your CRM, mail server and chat channel — which you choose.
In-region AI. Claude is also offered through major clouds in specific regions, and routing RevOS’s AI calls through an in-region endpoint would keep prompts inside the chosen geography. Not built yet — RevOS calls the Anthropic API directly today.
Workspace isolation
Each customer workspace is logically isolated: every table and every query is scoped to the workspace, and cross-workspace isolation is covered by automated tests.
Security controls
Access
- Sign-in with Google Workspace (OpenID Connect). SSO/SAML: in progress.
- Three roles — admin, manager, rep — enforced on the server for every endpoint.
- Sessions are server-side, revocable, and expire after 14 days; cookies are
HttpOnlyandSameSite=Lax. ASecurecookie by default: in progress.
Encryption
- In transit: TLS in every managed deployment.
- At rest: CRM tokens, mailbox credentials, webhook secrets and team-alert URLs are additionally encrypted in the database (Fernet: AES-128 with HMAC), with keys held outside the database and rotatable. Disk encryption is provided by the hosting platform and confirmed per deployment.
Control and auditability
- One approval engine for every CRM write and every outbound email; the default is approve.
- An append-only audit trail of who — a person or an agent — did what, when, and with what outcome.
- Every AI call is logged with its prompt version, model, cost and outcome; a hard monthly AI budget stops calls when it is reached.
- Inbound CRM webhooks are verified (signed, or with a per-workspace secret).
Outbound email
- One-click unsubscribe (RFC 8058 headers and a footer link), honoured immediately; unsubscribed and do-not-contact addresses are suppressed across every play.
- Daily sending caps, sending windows, and an automatic pause on reply or bounce.
AI
- Model provider: Anthropic (Claude), via API. Under Anthropic’s commercial terms, customer data sent through the API is not used to train models.
- AI output is grounded: each proposed CRM change carries the verbatim quote from the call that justifies it, and is approved by a person by default.
Engineering
- Automated backend, frontend and browser test suites run before every release, including architecture guards and multi-tenant isolation tests.
- Dependencies are pinned, and secrets are never logged.
Your rights and our commitments
- Data Processing Agreement available on request — aligned with GDPR Art. 28, with notes for the UK and the MENA data-protection laws.
- Subprocessors are listed in the DPA annex; customers are notified before changes.
- Deletion and export of workspace data at the end of a contract: on request today, within the period set in your DPA. Self-service export, retention settings and per-person erasure: in progress.
- Incident notification without undue delay, within the period set in your DPA.
Not yet available — stated plainly
| Item | Status |
|---|---|
| SOC 2 / ISO 27001 certification | Not certified; roadmap available on request |
| SSO / SAML, SCIM | In progress |
| Configurable data retention and self-service deletion | In progress |
| Third-party penetration test | Planned; date available on request |
Secure session cookie by default | In progress |