Security & BYOK architecture
Where your credentials live, what bring-your-own-key actually changes, and the one place our current architecture is narrower than we would like it to be.
Last updated 27 September 2026
1.Bring your own key, and what it means
TechSales orchestrates tools you already pay for. Wherever a provider supports it, you connect your own API key and the work runs on your contract, your rate limits and your quota. We never resell a provider's capacity to you.
The practical consequence is on the bill: an operation that runs on your own key costs zero TechSales credits, because there is nothing for us to pass through. Apollo lookups, CRM sync and every other BYOK-connected step are free of credits by construction, not by discount.
2.How credentials are stored
Every provider credential, without exception, is written into Supabase Vault: a dedicated encrypted secret store, separate from the application database. The table our code reads holds only a reference to the secret, never the secret. It is decrypted at the moment a job needs to call that provider and at no other time.
This is true whether you connect a provider yourself in Settings → Integrations or we enter a key for you under a Managed engagement. It was not always true of both: until September 2026 the keys we held on a managed client's behalf sat in an ordinary database column while customer-entered ones were already in the vault. That has been migrated, and the path an admin writes through goes to the vault by construction rather than by convention.
A key is never rendered back to the interface. Once saved you can replace it or delete it, but neither you nor we can read it out of the screen it was entered on.
All traffic between you, us and every provider is served over TLS.
3.Access
Workspace data is isolated per client and enforced at the database level by row-level security policies, not only in application code. A portal user sees their own workspace and nothing else.
Access to production by our own staff is limited to what is needed to operate and support the service. Sensitive fields are masked in the interface by default.
4.What we do not do with your data
We never resell, pool, aggregate or broker customer prospect data, and we never use one workspace to enrich another. We are an orchestration layer, not a data vendor.
We also do not train models on your prospect data. When the product drafts a reply or a follow-up hook, the specific thread and signal are sent to the model provider to produce that one output.
5.Your data on the way out
Leads, conversations and history are exportable at any time, on both plans, without asking us. Moving from Managed to a software plan is a billing change rather than a migration, and leaving entirely means exporting and closing the account. See the Terms for deletion timing.
6.Reporting a vulnerability
If you believe you have found a security issue, email tuna@techsalestr.com with enough detail to reproduce it. We will acknowledge within two business days. Please give us a reasonable window to fix it before disclosing publicly, and please do not access, modify or exfiltrate data that is not yours while testing.