Security
What the code protects. What you protect. What is not certified.
Outbound OS handles contact data and the ability to message people in your name, so its defaults are strict. Because the code is open, every control on this page can be read and checked.
At a glance
What is in place, and what is not.
- Role-based accessAdmin, manager, agent and viewer.In place
- Data scopingLead pools limit which records a user sees.In place
- Credential encryptionChannel credentials encrypted at rest (AES-256-GCM).In place
- Authenticated webhooksPer-source keys; provider signatures and secrets checked.In place
- Open sourceEvery control can be read and audited on GitHub.In place
- SOC 2 / ISO 27001Not certified. No audit has been carried out.Not yet
- Third-party penetration testNot yet commissioned.Not yet
In the code
Controls every install gets.
Product behaviour, not a compliance framework or a substitute for one.
- No default password
- The first admin gets the password you set, or a random one printed once. There is no built-in login that works on every install.
- Generated keys per install
- Session-signing and encryption keys are generated on first boot and stored beside the database, never shipped in the code.
- Encrypted credentials
- WhatsApp, email, iMessage and Telegram credentials are encrypted at rest with AES-256-GCM.
- Roles and lead pools
- Admin, manager, agent and viewer roles, checked on every API route; lead pools limit which records a user can see.
- Authenticated webhooks
- Lead sources need a per-source key, compared in constant time. Meta deliveries are signature-checked, and Brevo and iMessage webhooks are refused unless their secret is set.
- Rate-limited sign-in
- Repeated failed sign-ins and code requests are throttled.
- Activity log
- Who sent what, and when, tied to the person who acted.
Self-hosting
What falls to you.
Running your own install means the server is yours to protect: put it behind HTTPS, keep the host and Docker updated, keep .env and backups private, rotate credentials when people leave, and follow the consent and record-keeping rules where you operate.
Formal assurance
What does not exist yet.
Stated directly, so a review does not have to ask.
SOC 2 or ISO 27001
No certification is claimed and no audit has been carried out.
Third-party penetration test
No external penetration-test report exists to share.
Data processing agreement
Relevant only to managed hosting, where the maintainers process data for you. Not yet a standard published document.
Report a vulnerability privately.
Use GitHub’s private vulnerability reporting — never a public issue. Reports are acknowledged within three working days, with an assessment and fix timeline within ten.