Security
Maintained by Datakraft LLC for AblyWorks Reach
Encryption
All traffic to reach.ablyworks.com and to our APIs is served over HTTPS/TLS. Data is stored in a managed cloud database with encryption at rest. Third-party credentials you connect — such as WhatsApp provider tokens and outbound mail credentials — are encrypted with AES-GCM using a server-side key before they are written to the database and are never returned to the browser.
Tenant isolation and access control
Reach is multi-tenant. Every customer record belongs to a workspace, and database row-level security policies restrict reads and writes to members of that workspace. Application roles (owner, admin, member) are stored separately from user profiles and are evaluated server-side, so permissions cannot be changed from the browser.
Secrets and integrations
API keys and integration secrets are held in server-side secret storage and are only read inside server functions. No provider key, service key or database credential is bundled into frontend code. OAuth connections (for example Google Calendar) store tokens server-side and can be revoked by disconnecting the integration in Settings.
File sharing
Proposal and attachment files are stored in a private bucket. Links shared with recipients are time-limited signed URLs; the underlying files are not publicly listable.
Messaging compliance controls
Outbound email includes an unsubscribe path, and opt-outs are recorded in a suppression list that is honoured across campaigns, sequences and automations. Consent source and lawful basis are tracked per contact inside the app.
Shared responsibility
We are responsible for securing the Reach application and its infrastructure. You are responsible for the data you upload, the lawful basis on which you contact recipients, who you invite to your workspace, and keeping your own credentials safe. Your recipients' rights are handled through the privacy controls described in our Privacy Policy.
Reporting a vulnerability
If you believe you have found a security issue, email support@ablyworks.com with the details and steps to reproduce. Please do not publicly disclose the issue before we have had a chance to respond. We aim to acknowledge reports within one business day.