PLATFORM SECURITY & TRUST

Security Practices & Infrastructure

Verified Technical Safeguards • Last Updated: August 26, 2026

At Outtricks, security is engineered into every layer of our revenue operating system. We implement robust, verifiable technical controls to protect workspace data, multichannel communications, authentication lifecycles, and API integrations.

Authentication

Argon2 password hashing. The current memory-hard standard, not a general-purpose hash. Plaintext passwords are never logged or stored, and a login attempt against an address with no account still runs a hash, so response timing cannot be used to discover which addresses are registered.
Twelve characters, no composition rules. Deliberately: NIST SP 800-63B finds that forced symbols and mixed case push people toward predictable substitutions without adding real entropy. Length is the requirement.
Two-factor authentication with any authenticator app, over a TOTP implementation verified against RFC 6238's own test vectors. Turn it on in Settings, Security.
Signed OAuth state. The Google handshake carries a signed, time-limited state token, and post-authentication redirects are validated against an internal path list rather than trusted from the request.

What we do not have yet

Outtricks is a young company and we would rather you heard this from us than found it in a security questionnaire.

No SOC 2 report and no ISO 27001 certificate. Neither audit has been started. Any vendor page claiming these without naming the auditor and the report date is worth a second look, ours included.
No penetration test by an external firm. The controls on this page are real and implemented; none of them has been adversarially tested by a third party.
No HIPAA or PCI scope. Outtricks is not built to hold protected health information or cardholder data. Card details go directly to our payment processor and never reach our servers.

If a compliance requirement is blocking a decision, write to security@outtricks.com and you will get a straight answer about where we are, not a roadmap promise.

Anti-Brute-Force Rate Limiting

All authentication and sensitive endpoints are protected by sliding-window rate limiters:

Automated thresholds restrict login and signup attempts to a maximum of 5 requests per 60 seconds.
Repeated failures trigger temporary exponential backoff lockouts (3-minute minimum) to protect user accounts from credential stuffing.

Input Sanitization & Injection Defense

We implement comprehensive input validation across all user-supplied data:

Strict regex sanitization strips HTML tags, pseudo-protocols (javascript:, data:), and script characters before processing.
RFC 5322 regex validation on email addresses prevents malformed header injection.

Encryption in Transit & Security Headers

Data transferred between client browsers and Outtricks servers is protected using TLS 1.3 encryption. We enforce key HTTP security policies:

X-Content-Type-Options: nosniff: prevents browser MIME-sniffing attacks.
Referrer-Policy: strict-origin-when-cross-origin: prevents cross-origin URL data leakage.
Permissions-Policy: restricts unauthorized camera, microphone, and geolocation access.

Multi-Tenant Workspace Isolation

Every workspace is logically isolated. Database queries enforce workspace boundary checks to ensure that users can never access, query, or modify records belonging to another company or account.

Zero-Exposure Secrets Management

Server-side API keys, database connection strings, and private OAuth client secrets are never bundled into client-side JavaScript. Automated static analysis scans verify zero exposed credentials before production deployments.

Responsible Vulnerability Disclosure

We welcome responsible security research. If you discover a potential vulnerability in our platform, please report it directly to our security team. We investigate all credible reports promptly:

Outtricks Security Operations

Security Inquiries: security@outtricks.com