How we keep your workspace safe

• Passwords are hashed with bcrypt. We never store or log a password in plain text.
• Sessions are signed, HTTP-only, secure cookies that JavaScript cannot read.
• Google sign-in is supported, so you can inherit your organization’s own account controls.
• Password reset links are single-use and expire within an hour.
• Sign-in, sign-up and reset forms sit behind a Cloudflare bot challenge.

Every workspace object (products, agents, opportunities, prospects, documents, chats, scheduled jobs) is scoped to an owning workspace, and every query is filtered by it at the data layer rather than in the interface. Agent runs are scheduled per product and carry that product’s context only, so one customer’s agents cannot read, write, or be influenced by another customer’s data. Administrative access is limited to named super-admin accounts and exists to operate the platform, not to browse customer content.

• All traffic is served over TLS.
• Data is stored on managed PostgreSQL with encryption at rest and encrypted, access-controlled backups.
• Integration credentials (OAuth refresh tokens, mailbox passwords, API keys) are encrypted before they are written to the database, and are removed the moment you disconnect the integration.
• Platform API keys are held server-side only. They are never sent to the browser, and the admin panel shows only whether a key is configured, never its value.

Workspace content is sent to model providers only to serve your request, under terms that prohibit training on it. Agent output passes through code-level verification before you see it, and the reasoning trace is excluded from responses. Agents only read publicly accessible pages; they do not authenticate into third-party sites and do not access private content. Full detail is in the Privacy Policy.

• Least-privilege access to production, restricted to the people who operate it.
• Dependencies are kept current and patched for known vulnerabilities.
• Agent runs are budgeted, timed out and reaped, so a wedged job cannot exhaust shared capacity.
• Rate limiting and bot protection on public endpoints.
• Errors and access are logged for diagnosis and abuse investigation, without logging secrets.

If you find a vulnerability, email contact@revtive.com with steps to reproduce. We acknowledge reports within 1 business day and will keep you updated until it is resolved.

We will not pursue legal action against good-faith research that avoids privacy violations, data destruction, service degradation, and any access to accounts that are not your own. Please give us reasonable time to fix an issue before disclosing it publicly.

If a breach affects your data we will investigate immediately, contain it, and notify affected customers without undue delay, and in any case within the 72 hours GDPR requires, with what happened, what data was involved, and what we are doing about it.