The practical version of how we protect Funkel.

Authentication

Passwords are hashed with bcrypt at cost factor 10. We do not log, store, or transmit passwords in plain text. Sign-in uses a short-lived access token and a 7-day refresh token, issued and validated by the Go backend.

Google and LinkedIn sign-in use standard OAuth 2.0. We store only what we need to recognize the account on return visits.

Connected accounts and integration secrets

LinkedIn authorization is handled through our LinkedIn integration provider. Funkel stores the provider account ID and the metadata needed to route messages, replies, and webhooks. We never store your LinkedIn password.

Integration secrets such as Slack webhook URLs, Telegram bot tokens, and HubSpot access tokens are encrypted at rest with AES-256-GCM using a fresh nonce per write. The encryption key is held in a server-only environment variable and is never transmitted to the frontend.

Webhooks

Webhooks from Funkel to your endpoints must use HTTPS. We reject HTTP URLs when a webhook is created or updated. Every payload is signed with HMAC-SHA256 using a per-subscription secret; the signature is sent in the X-LeadPilot-Signature header so your handler can verify the request before acting on it. See Verifying webhook signatures for the implementation.

Webhooks we receive from connected integrations are also verified before we accept them. Requests without a valid signature are dropped before they reach the database.

Data isolation

Customer-facing queries are scoped to the authenticated user. Page components do not build their own ownership checks. There is no customer-facing mode for browsing another account.

Background jobs use their own query set and read the user ID from the job itself. That lets scheduled work run without loosening the rules on customer-facing requests.

Agent identity and action logs

Funkel can register AI agents with Compute ID AgentPassport. Each registered agent gets a verifiable identity and an action log that records what the agent did, when it ran, and the outcome.

These records support audit trails and EU AI Act Article 12 record-keeping reviews. AgentPassport audit logs are not included by default in the standard plan today. Email hello@funkel.ai if your team needs this.

Sender account safety

If LinkedIn flags an account, the damage is not just a failed campaign. You can lose access to a professional network you rely on. We treat pacing as part of account safety.

Each sender has weekly caps based on the account type. New senders ramp over fourteen days after their first successful outbound send. Sends are spaced out, and withdrawn invites create a cooloff before the same lead can be contacted again. The full rules are documented in Daily limits and account safety.

Payment data

Card numbers and bank details do not touch Funkel servers. Stripe handles billing. We store the references Stripe gives us, such as customer ID, subscription ID, and payment method ID.

If you find a vulnerability

Email security@funkel.ai with the details. We answer every report. With your permission, we will credit you after the issue is fixed. We will not pursue legal action against good-faith research.