How we protect Funkel AI.

Authentication

We store password hashes using bcrypt with cost factor 10. Sign-in requests send your password to the authentication service for verification. Sign-in uses short-lived access tokens and refresh tokens with a seven-day lifetime.

Google and LinkedIn sign-in use standard OAuth 2.0. We store only what we need to recognize the account on return visits.

Connected accounts and integration secrets

LinkedIn authorization is handled through our LinkedIn integration provider. Funkel AI stores the provider account ID and the metadata needed to route messages, replies, and webhooks. We never store your LinkedIn password.

Designated integration credentials, including Slack webhook URLs, Telegram bot tokens, and HubSpot access tokens, use AES-256-GCM using a fresh nonce per write. The encryption key is held in a server-only environment variable and is never transmitted to the frontend. This protection applies to designated credential fields, not every stored value.

Webhooks

Webhooks from Funkel to your endpoints must use HTTPS. We reject HTTP URLs when a webhook is created or updated. Every payload is signed with HMAC-SHA256 using a per-subscription secret; the signature is sent in the X-LeadPilot-Signature header so your handler can verify the request before acting on it. See Verifying webhook signatures for the implementation.

Incoming webhook checks depend on the provider and configured credentials. Stripe events use signature verification. LinkedIn provider events use verification when a webhook secret is configured.

Data isolation

API requests use authenticated identity and resource access checks. Team members can access another workspace when their membership and permissions allow it.

Background jobs carry account or workspace context for scheduled work.

Agent identity and action logs

Funkel AI can register AI agents with Compute ID AgentPassport. Each registered agent gets a verifiable identity and an action log that records what the agent did, when it ran, and the outcome.

These records help review agent activity. They do not establish regulatory compliance on their own. Contact [email protected] for details about your workspace.

Sender account safety

Sending controls reduce outreach volume and space actions over time. They cannot guarantee that a platform will not restrict your account.

Sender limits depend on account type and settings. By default, new senders ramp over fourteen days after their first successful outbound send. Eligible users can explicitly skip warmup. Sends are spaced out, and withdrawn invites create a cooloff before the same lead can be contacted again. The full rules are documented in Daily limits and account safety.

Payment data

Stripe handles payment collection. Funkel AI stores billing references and records, such as customer IDs, subscription IDs, payment method IDs, and invoice details.

If you find a vulnerability

Email [email protected] with the details. We answer every report. With your permission, we will credit you after the issue is fixed. We will not pursue legal action against good-faith research.