Trust & Security

Built on commitments — not promises.

Sales intelligence is sensitive work. SalesCanvas.ai is engineered so that every paid action, every credential, and every piece of generated content carries a verifiable safeguard. Here is exactly what we commit to — and how we enforce it in code.

100% Credit-Back Guarantee

Every paid action — briefings, organization profiles, refreshes — is automatically refunded if it fails for any system-side reason. Real-time, no support ticket required.

  • Refund posts within seconds of a failure — visible as a toast and in your unified inbox.
  • Full audit trail in the Usage Log with the originating action, failure reason, and refund amount.
  • One-click retry on any failed briefing pre-fills the same vendor, customer, meeting context, and depth.
Read the policy

Encryption & Token Security

Sensitive credentials never touch our application logs or backups in plaintext.

  • CRM OAuth tokens (HubSpot, Salesforce, Attio) encrypted at rest with Fernet (AES-128 + HMAC) using a per-environment key.
  • All transport is TLS 1.2+; HSTS enforced on every preview and production domain.
  • Passwords hashed with bcrypt (12-round cost factor); never stored or logged in any form.
  • Third-party API keys (payment processor, transactional email, error monitoring) live exclusively in environment variables — never in source control or images.

Data Privacy

Your briefings and CRM connections belong to you. We don't sell or share them.

  • We never sell, rent, or share your account data, briefings, or org profiles to third parties.
  • AI prompts and outputs are not used to train any model — Anthropic, Google, and OpenAI calls all run with model-training disabled where supported by the vendor.
  • Account deletion is GDPR Art. 17-compliant: schedule from Profile → Danger Zone, 30-day grace window to recover, then we hard-purge briefings, org profiles, alerts, CRM tokens, and usage history.
  • Self-serve data export (GDPR Art. 20 / CCPA): one-click ZIP download from Profile → Data & Privacy.
  • Cookie consent gated for analytics; strictly-necessary auth cookies only by default.
  • CRM sync: explicit two-way disclosure. You click Push to send briefings to your CRM. An optional hourly Pull reads only the most-recent Deal on Companies you've pushed to, purely to stamp outcomes — pause per-connection anytime.
Read our Privacy Policy

Honest AI Disclosure

AI-generated content is clearly marked, sourced, and never claims certainty it doesn't have.

  • Every briefing and org profile cites its sources — researchers can trace each claim to a public URL.
  • When public information is unavailable, the system writes "No public information found." — not generic industry filler.
  • Press-trigger refreshes show a "Why this update?" badge linking to the specific article that motivated regeneration.
  • AI outputs are professional intelligence, not legal/financial advice — see Terms § 6 for the full disclaimer.
Terms § 6 — AI Content

Reliability & Recovery

Long-running AI generations are designed to survive process restarts, network blips, and provider hiccups.

  • Background recovery agent re-promotes stuck briefings every 5 minutes; 3-retry budget before giving up and refunding.
  • Press-trigger watcher and monitoring crons persisted to our backend database so they survive container restarts.
  • Errors captured by our monitoring platform with a feedback widget on every page so you can flag any issue with one click.
  • Status banner on every page when a service degrades — no silent failures.

Account Security

Multiple layers of defense between an attacker and your account.

  • Brute-force protection: 5 failed logins → account locked for 15 minutes.
  • All authentication tokens are JWT (HS256) with 24-hour TTL and tied to a server-side issued secret.
  • Email-change confirmation requires verification on both the old and new addresses.
  • Password reset links are single-use and expire in 1 hour.

Enterprise & Compliance

If you're evaluating SalesCanvas.ai for enterprise rollout, we have a path.

  • SOC-2 Type I in active scoping with prospective auditors; Type II planned for 2026.
  • Per-org consent controls for AI training/research + per-org data-retention policies (auto-purge briefings + org profiles after 30/90/180/365 days, with a 30-day grace window + per-item Legal Hold exemption).
  • Customer DPA available on request for any tier — written by GDPR/CCPA-aware counsel.
  • Audit logging of admin and credential-change events; per-seat usage caps available on Enterprise.
  • Single Sign-On (SAML/OIDC) on the Enterprise roadmap — ask sales for current ETA.
  • Subprocessor list available at /sub-processors — versioned record of every third-party that processes customer data, reviewed quarterly.
Talk to sales

Found a security issue?

We take responsible-disclosure reports seriously. If you've identified a vulnerability in SalesCanvas.ai — please email security@salescanvas.ai with reproduction steps. We acknowledge every report within 48 hours, will not pursue legal action against good-faith researchers, and credit reporters in our monthly changelog (with permission).

Ready to put this to work?

Start free with 10 credits — no card required. The credit-back guarantee is in effect from your first briefing.