Security & Compliance

Anything that could make a billable, outbound, or external call is gated behind an explicit environment switch and a credential. With defaults, the entire product runs in a safe, mocked mode that makes no external requests.

• LIVE_PROVIDER_CALLS_ENABLED — required (plus a provider key) for any paid provider call.
• OUTBOUND_MESSAGING_ENABLED — required for any outbound message.
• ALLOW_PUBLIC_WEB_EXTRACTION — required for any live web fetch.
• WEBHOOKS_ENABLED — required to actually deliver outbound webhooks (otherwise recorded only).

Each enriched value records where it came from, when, and with what confidence. You can always answer “why is this in my data?” — essential for audits and for honoring deletion requests.

The compliance engine classifies every record GREEN / YELLOW / RED and checks it against opt-out and Do-Not-Contact lists. Records that are blocked, opted-out, archived, or lack provenance are automatically excluded from exports.

• Official, licensed provider APIs and your own uploaded data.
• Optional safe extraction of public business pages — robots.txt respected, rate-limited, size- and time-capped.
• No scraping of login-walled platforms, no rotating proxies, no CAPTCHA bypass, no fake accounts.

Every server-side request to an address you can influence is validated against a strict guard — loopback, private, link-local, and cloud-metadata hosts are blocked, including encoded and trailing-dot variants. This applies to:

• Public-page extraction — every URL and every redirect hop is re-validated; requests are bounded by timeout, max pages, and max bytes.
• Webhook delivery — endpoints must be https, pass the SSRF guard at creation and before each send, and redirects are never auto-followed.
• CRM connections — a customer-supplied Salesforce instance URL must be https and a Salesforce host before any authenticated call.

The compliance moat is built in, not bolted on — designed for GDPR / CCPA and enterprise procurement:

• A hosted preference center where anyone can opt out or file a data-subject request; opt-out / erasure / objection are honored immediately and suppress the email everywhere.
• One-click provenance & audit reports proving where every field came from.
• A sub-processor registry with an auto-generated DPA, plus full audit-log export (Enterprise).
• Programmatic access (API, CRM sync, webhooks) runs through the same eligibility filter as exports — a suppressed contact is never re-emitted.

• HMAC-signed session cookies; scrypt password hashing.
• Role-based access control (Owner / Admin / Member / Viewer) enforced at the API layer.
• Bring-your-own provider keys and webhook secrets encrypted at rest with AES-256-GCM; only a last-4 hint is shown.
• Customer API keys are hashed at rest, shown once, revocable, and rate-limited per key.
• Constant-time comparison for secrets/tokens; secrets are never logged or exposed in the UI.
• Security headers (X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy).
• Append-only audit log of sensitive actions, exportable on Enterprise.

Found a vulnerability? Email hello@divineastromedia.com with details and steps to reproduce. We'll acknowledge promptly and keep you updated.