Security
How we handle your data.
An accurate description of current controls. ReachRova does not claim certifications it has not obtained.
Tenant isolation
Every record carries a workspace ID; every API checks membership and role on the server.
Server-side secrets
AI and provider credentials stay on the server and are never exposed to the browser.
Global suppression
Opt-outs and blocklists are enforced at qualification, approval and dispatch time.
Untrusted content
Website text, imports and inbound replies are treated as data; instructions inside them are ignored.
Audit records
Approvals, exports and authorization changes are recorded with who and when.
Isolated demo
The demo workspace contains fictional data and can never send messages.