Security and compliance
Security you can show a reviewer
Algominds handles the companies you sell to and the messages you send. This page describes what we actually do about that: the controls that are live today, the certifications we do not hold, and the places we will not claim more than we can show you.
Every badge in lime is live in production today and we will show you the control behind it. We are not SOC 2 or ISO 27001 certified, we hold neither report, and we would rather lead with that than bury it.
Where we stand
Every claim here maps to a control.
Six of these seven are running in production today. The seventh is the report we do not hold, listed here rather than left out.
Data Processing Agreement
PublishedSets out how we process your data. You remain the controller; we act as processor to run the service.
Read the DPAEncryption in transit
EnforcedTLS on all traffic, with HTTP Strict Transport Security set to two years and includeSubDomains on our application domains.
Verifiable in our response headers
Credential encryption at rest
Enforced on writeIntegration credentials and OAuth tokens are encrypted with AES-256-GCM, with a fresh initialisation vector per record, before the application writes them to our database.
Credentials and secretsSending controls
EnforcedOn the self-serve product nothing sends until you launch it. A reply cancels the remaining follow-ups on that channel, every sending account carries a daily cap, and connection requests carry a weekly cap on top.
What Algominds doesSecret scanning and dependency audit
Runs in CIEvery pull request into main runs a secret scan across our git history and a dependency audit that fails on any high or critical advisory. Both report; neither is a merge block today.
Responsible disclosureData export and deletion
Self-serveExport and delete your account from Settings while your plan is active. Deletion also cancels billing and revokes your connected sending accounts. If your plan has lapsed, ask us and we will action it.
Privacy PolicySOC 2 / ISO 27001
Not certifiedWe hold neither report, no audit is in flight, and we would rather say that than describe a programme we cannot show you. We answer security questionnaires and share our current documentation, including its known gaps, under NDA.
Request security details
| Standard | Status | Coverage | Documentation |
|---|---|---|---|
| Data Processing Agreement | Published | Sets out how we process your data. You remain the controller; we act as processor to run the service. | Read the DPA |
| Encryption in transit | Enforced | TLS on all traffic, with HTTP Strict Transport Security set to two years and includeSubDomains on our application domains. | Verifiable in our response headers |
| Credential encryption at rest | Enforced on write | Integration credentials and OAuth tokens are encrypted with AES-256-GCM, with a fresh initialisation vector per record, before the application writes them to our database. | Credentials and secrets |
| Sending controls | Enforced | On the self-serve product nothing sends until you launch it. A reply cancels the remaining follow-ups on that channel, every sending account carries a daily cap, and connection requests carry a weekly cap on top. | What Algominds does |
| Secret scanning and dependency audit | Runs in CI | Every pull request into main runs a secret scan across our git history and a dependency audit that fails on any high or critical advisory. Both report; neither is a merge block today. | Responsible disclosure |
| Data export and deletion | Self-serve | Export and delete your account from Settings while your plan is active. Deletion also cancels billing and revokes your connected sending accounts. If your plan has lapsed, ask us and we will action it. | Privacy Policy |
| SOC 2 / ISO 27001 | Not certified | We hold neither report, no audit is in flight, and we would rather say that than describe a programme we cannot show you. We answer security questionnaires and share our current documentation, including its known gaps, under NDA. | Request security details |
What the product does
What it does, and what it will not do.
Algo is the AI sales rep that reads your pipeline in Slack. Every line below maps to a control in the product, and the right-hand column is the half a security reviewer actually asks about.
What Algominds does
- Waits for you to launch. On the self-serve product a campaign only enters the send queue after you launch it in the dashboard, and the sequencer refuses any campaign that is not in that state. On our managed service, where you are paying us to run outbound for you, we launch on your behalf once a build is approved. Set your account to review mode and every build waits for a person instead.
- Holds each message for a business-hours window. Sends are gated to 9am to 5pm on weekdays in the campaign's timezone, and a message that comes due outside that window is deferred rather than sent.
- Stops on reply. A reply by email or LinkedIn cancels the remaining follow-ups on that channel, and an automated out-of-office is detected on email so a vacation responder cannot silently kill a sequence. On our coordinated two-channel sequences the reply stops the other channel for that person too.
- Caps every sending account. Connection requests, messages, InMails and emails each carry their own daily limit, connection requests carry a weekly limit on top, and free LinkedIn accounts run under a lower invitation regime. The cap is reserved in the database before the provider is called, so a send is refused at dispatch once it is hit.
- Lets you export or delete your account yourself, from Settings, while your plan is active. If you own a workspace with other members still in it, we ask you to transfer or remove them first.
Credential handling has its own section: Credentials and secrets.
What it never does
- Never starts a self-serve campaign you have not launched. It sends only once you set it live in the dashboard, and the sequencer refuses anything else.
- Never lets Algo change anything in Slack. Its tool belt is a read-only allowlist of six lookups, so a mutating tool is excluded by default rather than by review.
- Never puts a credential into the text of a model prompt. Keys are passed to the provider SDK, never as message content.
- Never writes your LinkedIn or mailbox password to our database or logs. There is no password column anywhere in our schema, and connection request bodies are not logged.
- Never records what you type. Session replay masks all input fields, and error reports are sent with personally identifiable information disabled.
- Never lets one account act on another. Export and deletion are scoped to the signed-in user. There is no account id to pass in.
- Never claims a certificate we do not hold. We are not SOC 2 or ISO 27001 certified, and we would rather print that sentence than hint at a programme we cannot show you.
AI safety
Algo reads other people’s text. That is the threat model.
Where a model reads text someone else wrote, we say exactly how far the fencing goes and where it stops.
Prompt injection
Algo reads channel history that other people wrote, including single-channel guests and external Slack Connect members. That history is treated as untrusted input: fence and control tags are neutralised in any casing, the transcript is wrapped in a labelled untrusted block, and only the message that actually addressed the agent is marked as actionable. The system prompt names the threat and tells the model the block is data, never instructions.
Scope, plainly: this is input sanitisation and prompt-level fencing on the Slack surface. Content our models read while researching an account does not carry the same fencing today and we will not pretend otherwise. What bounds it is structural: Algo holds no mutating tools, so nothing it reads can put a message in front of a prospect.
Model providers
Model calls are made server-side. Provider keys are resolved from a managed vault at request time and handed to the provider SDK as transport credentials, never written into a prompt. We use more than one model provider, and some traffic is routed through a model gateway.
We are correcting our published sub-processor list so it names every provider and gateway in that path. Until it is accurate we would rather point you at a person than a stale table: ask us and we will send the current list in writing. On training, what a third-party provider does with content submitted to it is governed by that provider's terms, not ours, and we will not print a blanket promise we cannot enforce on your behalf.
Memory and isolation
Where your Slack workspace has completed its own install, Algo answers on your workspace's own bot token, stored encrypted and scoped to that workspace. The incoming Slack team maps to exactly one workspace, and every lookup it makes is bound to that workspace's records. Integration secrets sit behind row-level security with access granted to the server role only, so no browser-side key can reach them.
Algo carries nothing between conversations. Its prompt is the system prompt, the sanitised channel transcript and your question, and it is bounded to five steps before it has to answer.
Credentials and secrets
Every secret, handled on its own terms.
Integration credentials and OAuth tokens are encrypted with AES-256-GCM, with a fresh initialisation vector per record, as the application writes them to our database, using a key resolved from our managed secret store at request time rather than one committed to code. Here they are one by one.
Your Algominds account password
Handled by our authentication provider, which stores only a salted hash. We never see the password itself, and it is never written to our own tables.
Connects through a browser connector that shares only an encrypted session. A direct sign-in exists for accounts the connector cannot complete: those credentials are relayed over TLS to our connection provider and are not written to our database or logs.
Mailboxes
Mailboxes connect through OAuth. SMTP uses an app password you generate and can revoke yourself, forwarded to our sending provider, never your real account password.
API keys you mint
We store only a sha256 hash of each key plus a short display prefix. The full key is shown exactly once at mint time and can never be retrieved again, by you or by us. Revoke any key and every request using it fails from that moment.
Response headers, on every request
Strict-Transport-Security
Two years, includeSubDomains. The preload directive is set, but the domain is not yet on the browser preload list.
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'
Enforced, and reported to our own collector. The modern form of the line above, sent as its own policy so that framing is blocked outright while the rest of the policy is still being validated.
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy
Denies camera, microphone, geolocation, payment and USB.
Cross-Origin-Opener-Policy: same-origin-allow-popups
Content-Security-Policy-Report-Only
Everything else in the policy, script and style sources included. Not enforcing yet, while the allow-list is validated.
Responsible disclosure
Found something? Email [email protected] with the details and a reproduction, and please do not open a public issue first. We do not run a paid bounty today, and we would rather say so than imply one. We ask that you avoid accessing, changing or deleting anyone else’s data while testing, and that you give us a chance to ship a fix before disclosing publicly.
On our side, every pull request into main runs a secret scan across our git history and a dependency audit that fails on any high or critical advisory, alongside type checks, linting and the test suite. Both report rather than block the merge today, and we would rather tell you that than let you assume a gate we have not turned on.
Your data, your control
You stay the controller.
- You stay the controller of your data. We process it to run the service under our DPA.
- Export and deletion are self-serve from Settings while your plan is active, not a support ticket. If it has lapsed, ask us and we will action it.
- Deleting your account cancels billing and revokes your connected sending accounts.
- Outreach follows our Acceptable Use Policy and applicable law.
Questions
Straight answers, including the awkward ones.
Certification, credentials, and what stops a message going out.
Are you SOC 2 or ISO 27001 certified?+
No. We hold neither report, no audit is in flight, and we are not going to describe a programme we cannot show you. What we can show you is on this page: the controls that are live in production, and a written security policy that names its own gaps: no penetration test yet, no separation of duties in a company this size, a Content-Security-Policy whose script and style rules are still report-only rather than enforced. We share that documentation, gaps included, with prospective customers under NDA. If we are ever certified, the reports will be published here.
Do you store my LinkedIn or mailbox password?+
No. There is no password column anywhere in our schema. Mailboxes connect through OAuth, and LinkedIn through a browser connector that shares only an encrypted session. Where a credential is needed to establish a connection it is relayed over TLS to our connection provider and is not written to our database or logs. Your Algominds account password is separate: it is handled by our authentication provider, which stores only a salted hash, so we never see it.
Can the Slack agent send messages or change my campaigns?+
Not from Slack. Algo's tool belt is a read-only allowlist of six lookups: campaigns, campaign status, campaign analytics, leads, a single lead, and replies. Mutating tools such as pause, resume, retarget and rewrite exist in the product but are excluded from that allowlist, so they cannot be reached from Slack. To be precise rather than flattering: those mutating tools are reachable through our MCP connector by a caller holding one of your own API keys, which is the point of that connector. Revoking the key closes it.
Is my data used to train AI models?+
No credential of yours ever enters a model prompt: keys are passed to the provider SDK as transport credentials, never as message content. Beyond that we will be straight with you. We use more than one model provider and route some traffic through a model gateway, and what those third parties do with content submitted to them is governed by their terms, not ours. We will not print a blanket 'never used for training' promise we cannot enforce on your behalf. Ask us and we will send the current provider list in writing.
What stops Algominds emailing someone I did not approve?+
Four things, in order. On the self-serve product nothing enters the send queue until you launch the campaign in the dashboard. On our managed service we launch on your behalf once a build is approved, which is what you are paying us to do, and review mode puts a person in front of every build. Each message then waits for a business-hours window, 9am to 5pm on weekdays in the campaign's timezone. Every sending account carries a daily cap, connection requests a weekly cap as well, and the cap is reserved before the provider is called, so a send is refused at dispatch once it is hit. And when someone replies, the remaining follow-ups on that channel are cancelled; on our coordinated two-channel sequences the other channel stops too.
How do you handle prompt injection?+
On the Slack surface, where Algo reads messages other people wrote, the transcript is sanitised, wrapped in a labelled untrusted block, and only the message that addressed the agent is treated as actionable, and the model is told the block is data, never instructions. We scope that claim honestly: content our models read while researching an account does not carry the same fencing today. What limits the blast radius is structural, because Algo has no mutating tools, so nothing it reads can put a message in front of a prospect.
Can I export or delete my data?+
Yes, both from your settings, without asking us. Export gives you a machine-readable copy of your own account data: your profile, workspaces, ICPs, campaigns, connected-account metadata and billing summary. Prospect records about other people are summarised as counts, and no secret is ever included. Deletion removes your account and the data you own, cancels billing, and revokes your connected sending accounts. Three limits worth knowing: Settings sits inside the product, so if your plan has lapsed you should email us and we will action it; if you own a workspace that still has other members, we ask you to transfer or remove them first; and if we cannot reach our billing provider to cancel an active subscription we refuse the deletion rather than leave you being charged, and finish it by hand.
How do I report a vulnerability?+
Email [email protected] with the details and a reproduction, and please do not open a public issue first. We do not run a paid bounty today. We ask that you avoid accessing, changing or deleting anyone else's data while testing, and that you give us a chance to ship a fix before disclosing publicly.
Security questions or a vendor review?
We answer security questionnaires and share our current documentation with prospective customers under NDA. Ask us anything on this page and we will show you the control behind it. A founder reads that inbox.