Nº 01 · Security
How SIGNL keeps each client's data apart from the rest.
The controls in place today, each one traced to the code that provides it.
Each client in its own workspace
- Row-level security on every table. Every table SIGNL creates in its database has row-level security switched on and at least one access policy, or is listed, with a written reason, as one only SIGNL's own server can reach. A test fails when a new table breaks this.
- The server scopes first; row-level security is the second lock. SIGNL's code is written to scope each query to your organisation or workspace before it reaches the database, so row-level security is a second lock, not the only one. A test runs every tool the Agent, MCP and the REST API share and checks each query is pinned to its workspace; another runs automation steps against two workspaces' data and checks each finds only its own.
- A team member can be limited to one client. Pin a member to one client workspace and they reach that workspace only. The app enforces it, and so do the database's own row-level policies.
Keys, connections and the Agent
- API keys are stored as hashes. A key is shown once, when you create it. SIGNL keeps a SHA-256 hash of it, so a key cannot be read back, only replaced.
- Claude can connect through OAuth with PKCE. Claude and other MCP clients can connect through OAuth with PKCE. Read access is always included, and you choose on the consent screen which kinds of change to allow. Disconnecting an app revokes its tokens, and a revoked token stops working on its next call.
- Inside SIGNL, the Agent asks first. Inside SIGNL, the Agent proposes a change and waits. Only your approval runs it.
- Changes made through MCP are logged. When a change made through MCP succeeds, SIGNL writes it to your audit log. If the log write itself fails, the error is recorded for SIGNL to investigate.
- An audit log, kept 395 days by default. Actions such as creating an API key or disconnecting an app are written to your organisation's audit log. Entries are kept for 395 days by default.
- The API and the MCP server are rate limited. Requests to the REST API and to the MCP server are limited per IP address and per key.
Webhooks, headers and error reports
- Incoming webhooks are verified before SIGNL acts on them. Webhooks from Stripe, Whop, Twilio and the other platforms that sign their requests are checked against their signature. Where a sender does not sign, SIGNL requires a secret token instead. A webhook that fails either check is refused before SIGNL acts on it.
- Webhook endpoints are signed by default. A new outgoing webhook endpoint gets its own signing secret, and each delivery carries an HMAC-SHA256 signature of its body. Endpoints in Discord's format are sent unsigned, because Discord does not check a signature. Webhook and HTTP steps inside an automation send the headers you set and are not signed by SIGNL.
- HTTPS only, and app pages refuse to be framed. Every response tells browsers to use HTTPS only (HSTS) and not to guess a file's type. App pages cannot be shown inside another site's frame; booking, form, VSL, report and recording embed pages can, because they are made to be embedded.
- Error reports are scrubbed before they are sent. Error reports go to Sentry with Sentry's option to send default personal data switched off. Email addresses, phone numbers and credentials are masked by pattern before a report leaves SIGNL; your account id is kept so an error can be traced. Session replay runs only after you accept it in the consent banner, with all text and media masked.
Where data is kept
- The database is in the EU. SIGNL's database, which holds your workspace data and recordings, is hosted by Supabase in the AWS eu-north-1 region (Stockholm). The providers below may process data elsewhere; a region is shown only where it is published.
The service providers that process personal data on SIGNL's instructions. The privacy policy lists the same ones, and names the independent organisations, such as Whop and Google, that we also share data with.
| Provider | What for | Data it receives | Region | Listed since |
|---|---|---|---|---|
| Supabase | Database hosting, authentication, and storage of recordings | Account and workspace data, the business data you enter or connect, and recordings with their transcripts and summaries | EU: AWS eu-north-1 (Stockholm) | 23 Jul 2026 |
| Vercel | Application hosting | Requests to the app, with the IP address, browser type, page and time of each | Not yet published | 23 Jul 2026 |
| Anthropic | AI-assisted features (Insights, Ask AI, Training) and recording summaries | Workspace data sent to answer an AI request you make, and recording transcripts sent for a summary | Not yet published | 23 Jul 2026 |
| Deepgram | Speech-to-text for recording transcripts | The audio of a recording, to produce its transcript | United States | 10 Sep 2026 |
| Resend | Transactional email delivery | The recipient address and content of each email SIGNL sends | Not yet published | 23 Jul 2026 |
| Sentry | Error monitoring and, only if you opt in, session replay | Error reports with the page address and your account id, masked by pattern before sending; session replay with all text and media masked, only if you accept | EU (Germany) | 29 Sep 2026 |
| Twilio | Delivery of text messages for businesses that send through SIGNL's own messaging account or a messaging account SIGNL manages for them; a business that connects its own Twilio account uses Twilio as its own provider | The phone number and text of each message sent through SIGNL's messaging account, and delivery and reply records | United States | 30 Sep 2026 |
| Composio | Connecting the third-party apps you choose to link to your workspace | The data the apps you connect are set up to share | Not yet published | 30 Sep 2026 |
| Bunny | Video hosting and streaming for VSL pages | The videos you upload for VSL pages | Not yet published | 30 Sep 2026 |
| Upstash | Rate limiting, which stores request counts against an IP address for a short time | Request counts against an IP address, for a short time | Not yet published | 30 Sep 2026 |
Taking your data with you
- Export your data. Leads, calls and commissions export as CSV from a workspace's settings, and an agency can export them across every client. The organisation owner can ask for a workspace export, which is built in the background and emailed as a link that works for 7 days. A manifest in the export lists anything left out and why.
What this page does not claim
SIGNL does not hold SOC 2 or ISO 27001.
This page lists only controls that exist in SIGNL's code today. Each claim names the code behind it, and a test fails if that code is removed or changed.
Report a vulnerability
Email security@trysignl.app if you find a security problem in SIGNL.
Say what you found, where, and the steps to reproduce it. Please do not access other people's data to show a problem.
No reply time is promised, and SIGNL does not run a bug bounty.
The same contact is published at /.well-known/security.txt.