Security and privacy

This page is the short version of how sourcesignal protects your account and the data in it. Read it when you set up a team, connect a mailbox or analytics, or answer a security review. The Privacy Policy and the Terms of Service are the full statements.

Your data stays inside your organization, connecting an account never gives sourcesignal its password, and no outreach email goes out without your approval.

Account security

You sign in with an email and password, or with Google, Microsoft or GitHub where the sign-in page offers them. Single sign-on asks the provider for your identity only: your name, email address and profile.

• Passwords. sourcesignal never stores your password. Password and email changes go through the authentication provider, never straight into the database.
• Password length. At least 8 characters when you sign up or reset it, and at least 10 when you change or set one in your profile.
• Changing your password needs your current password. A signed-in browser on its own is not enough.
• Changing your sign-in email sends a confirmation link to your current address and to the new one. The change lands only after both links are clicked.
• Reset links expire after an hour and work once.

If you think your account was compromised

1. Open Settings, then Profile, and press "Sign out of all other devices" on the Sessions card.
2. Confirm with "Sign out everywhere else". Every other browser and device is signed out at once and needs your password or single sign-on again. The browser you are using stays signed in.
3. If your account has a password, press "Change password" on the Account card and choose a new one.
4. Tell hello@sourcesignal.ai what happened.

The full controls are in Profile and sign-in.

Workspace isolation

Everything you create belongs to your organization (your workspace): projects, members, mailboxes, the do-not-contact list, billing and support conversations. Access is scoped per organization and enforced in the database itself, not only in the app. A second organization has its own plan and its own bill.

Inside an organization, you decide who sees what:

• Roles. Owners control everything, including billing and ownership. Admins manage the team and billing. Members work in projects. Nobody can assign a role above their own.
• Project reach. Members see every project by default. An owner or admin can narrow a member to specific projects, and the rest disappear for them everywhere (the project switcher, reports, opportunities and outreach) from their next page load. Owners and admins always see every project.
• Removing someone. A removed member loses access immediately. The work they created stays.
• Account-wide controls. Only owners and admins can download the account's data, rename the organization or manage the Ahrefs token. Only an owner can delete the organization.

The steps are in Members and roles.

What is stored and why

sourcesignal keeps what the product needs to do its job:

• Account data: your name, email address and organization, and sign-in records held by the authentication provider.
• Data you connect: the connection reference and the settings you choose for each mailbox, analytics property or data provider, plus the access token a Google or Ahrefs connection needs (see the table below).
• Outreach data: the pages you target, the business contacts found for them (name, work email, job title and the public source each came from), the emails drafted and sent, and the replies received.
• Usage data: server logs, and a record of AI operations for billing and diagnostics.

Business contacts are publicly available professional details. sourcesignal buys no contact lists and sends no bulk untargeted mail. For the people you contact on behalf of your clients, you are the data controller and sourcesignal is your processor. Anyone emailed through the platform can write to hello@sourcesignal.ai to be removed: the address is suppressed across the platform and the request goes to the customer who sent it. Your own list lives in Do not contact.

How AI is used

Drafting, classification and analysis run through an AI provider.

• Content sent for these purposes is not used to train models.
• Every AI-drafted email is shown to you for review, and nothing sends without your approval: your own press, or "Emails and posts to publishers" set to apply at once for Spot or your agent under Settings, Agents. A mandate never sends one. Drafts can be wrong, so read each one before you approve it.
• Reply content is processed to read its sentiment and to spot out-of-office replies and delivery failures.
• Google Analytics and Search Console data is never sent to AI providers.
• Spot, the in-app agent, changes nothing on its own unless your setting under Settings, Agents applies that kind of change at once, where it shows as applied with "Take back" for a day. Every other change arrives as a card that you apply, edit or dismiss, and some cards offer Undo for ten minutes after you apply them.
• Your own agent, connected over MCP, works as you with only the scopes you give its token. It sends a pitch or a reply only where that row applies at once, never under a mandate. It never pays anyone, never touches billing, members or access, never connects a mailbox, and never claims a win or confirms a placement without you. It makes a change on its own only where your setting under Settings, Agents applies that kind of change at once, or under a mandate you approve: the changes the mandate names, within the limits you set and until the mandate ends. See Agent scopes and limits.

Connected accounts and credentials

Connecting an account never hands sourcesignal its password. Each connection keeps as little as it needs, and you can take it back from the page that made it.

Payments run through Stripe, and card data never reaches sourcesignal.

• When you connect a mailbox, the connection screen names the service that connects inboxes to sourcesignal, whether it is Google's or Microsoft's consent screen or, for other email, that service's own hosted page. The Mailboxes page says so under the Connect buttons. Disconnecting a mailbox stops sending from it, and nothing already sent is recalled or deleted. See Mailboxes.
• Google data is used only for your project's Traffic & Search reporting. It is never used for advertising, never sold, never combined across customers and never used to train AI models. You can also revoke access from your Google account permissions page. Metrics already retrieved stay in the project's report history until the project is deleted or you ask for their removal. See Traffic from Google Analytics 4 and Search Console.

Sub-processors

The service runs on a small set of providers, and each receives only what its function requires. The Privacy Policy names every one with its purpose and the data involved. In summary:

Some of these providers process data outside the UK and EEA. Those transfers rely on Standard Contractual Clauses or an equivalent safeguard.

Report a security issue

Email hello@sourcesignal.ai. The same contact is published in the site's security.txt file. Data is encrypted in transit and at rest, the site is served over HTTPS only, and its pages cannot be framed by another site.

Your rights

• You can ask for access, correction, deletion, restriction or portability of your personal data, or object to processing based on legitimate interests. Write to hello@sourcesignal.ai. sourcesignal responds within one month, and you can also complain to your data protection authority.
• You keep ownership of everything you put in and of the outreach you send. An owner or admin can download the account's data at any time, and an owner can delete the organization: see Your data.
• When processing changes, the Privacy Policy is updated, and account holders are told directly about material changes.