Trust

Keep Warm texts people on your behalf, so here is exactly what the software does, and what it does not do.

Workspaces are kept apart in the application

Every table that holds customer data carries an org_id, and every query the app runs is scoped to the signed in workspace. An automated isolation test creates two workspaces and checks that the second sees zero rows from the first, for every tenant table. Isolation is enforced in application code, not by Postgres row level security (not RLS).

Sending is supervised

Automatic sending to prospects is off by default. Any reply pauses the sequence and goes to the closer who took the call. STOP suppresses that number for good. Payment links are never sent by the software.

Secrets and logs

Integration keys are encrypted before they are stored and are never returned by the API. Every change is written to an audit log, with secrets redacted before they are stored and again when they are read.

The web app

Every page carries a per request content security policy with a nonce. Every API route is rate limited. Routes that act on your data check the session and role on the server; webhooks verify a signature instead and refuse when no secret is set.

What we do not claim

Keep Warm is not SOC 2 audited, is not HIPAA compliant, and does not market itself as enterprise grade. If your security review needs something we have not listed here, ask us and we will tell you plainly whether it exists.