Security

Your domains

• We never send cold email from your main domain. Outreach runs on separate sending domains and inboxes we set up and warm up for you.
• If you leave, you keep your interested leads and can export your data from the client portal.

The client portal

• Sign-in is handled by Clerk. A client user can only sign in with an email address on that client's own domain.
• Every connection is encrypted with TLS 1.2 or newer, and browsers are told to use HTTPS only (HSTS).
• The portal's pages can't be embedded in other sites, which blocks clickjacking.

Infrastructure

• This website runs on Vercel, the client portal on Cloudflare, and our databases on Neon (Postgres) in the United States.
• The oneaway.io domain is signed with DNSSEC and limited by CAA records to the certificate authorities we use.
• Our own email is protected with SPF, DKIM and DMARC.

Documents on request

We sign a data processing agreement (DPA) with clients who need one, and share our subprocessor list and answer security questionnaires under NDA. Email privacy@oneaway.io.

Report a security issue

Found a vulnerability? Email privacy@oneaway.io. Our security.txt has the details.

Privacy

How we collect and use personal data is in our privacy policy.