Security
Your leads stay yours.
Here's exactly what Qnal does today.
Security controls
3 controls
Who sees what
Tenant isolation.
Your data is walled off from every other company.
Roles.
Owner, admin, editor and analyst.
Audit trail.
Sign-ins, approvals and sends are logged.
4 controls
The people in your leads
Consent on record.
The exact wording each person agreed to, and when.
Unsubscribes honored.
Checked before every send.
No raw IP addresses.
Never stored.
Privacy requests.
Find, export or delete a person's data.
4 controls
Secrets, links and delivery
Encrypted credentials.
Mailbox and CRM tokens are encrypted at rest.
Signed webhooks.
Verify every delivery came from Qnal.
Unsafe links blocked.
Known bad destinations never redirect.
Data in the US.
Your data is stored in the United States.
What we do not claim
Qnal is not SOC 2 certified, and we will say so until it is.
Security questions: hi@qnal.com
See also the privacy policy (draft).
FAQ
Questions
How is our data kept separate?
Row-level security at the database. Members see only the workspaces they belong to.
Who can send a follow-up?
Only the rep who owns the lead, after approving it. API keys and AI tools can't send.
How is consent recorded?
Per purpose, with the exact wording the person saw and when. Consent records are kept as evidence, even if the lead is deleted.
How do unsubscribes work?
Every follow-up has an unsubscribe link. Suppressed addresses are stored hashed and checked before every send.
Do you store IP addresses?
No. Visitor counts use a daily salted hash.
How are credentials protected?
Mailbox connections, CRM tokens and webhook secrets are encrypted at rest. API keys are shown once.
How do we handle a privacy request?
Find the person by email, then export their data as JSON or delete it.