Security and Data - Verified prospecting data your team can audit

Data behavior table

Area	Expected control	Status	Buyer verification
Source provenance	Record provider or public source per consequential field	Config-dependent	Inspect sample output and connector setup
Refresh cadence	Preserve checked time and recheck before use	Provider-dependent	Review current provider documentation
API keys	Runtime secret store with least privilege	Operator-controlled	Inspect scope, logs, rotation, and revocation
Local execution	Review package actions, network calls, and files	Not asserted here	Test in an isolated environment
Exports	Approved destinations with access controls	Config-dependent	Trace file, CRM, and engagement-tool copies
Deletion	Remove downstream copies as well as package data	Operator-controlled	Exercise deletion and document exceptions
Human review	Approval before outreach or bulk export	Workflow requirement	Test role and permission boundaries

“Not asserted here” means current first-party evidence is required. It is not a negative security score.

Evidence checklist

Package review: confirm package identity, version, maintainer information, requested actions, update path, and uninstall behavior.
Credential review: verify storage, scope, encryption, logging, rotation, revocation, and incident-response ownership.
Provider review: inspect subprocessors, geographic processing, retention, deletion, rate limits, and permitted uses.
Record review: preserve provenance, checked time, inference status, reviewer identity, suppression, and correction history.
Outbound review: separate technical verification from lawful basis, relevance, opt-out, sender authentication, and delivery monitoring.
Framework evidence: request current audit or certification documents directly; SOC 2, ISO 27001, GDPR, and CCPA/CPRA names here are evaluation categories only.

Security and privacy are shared operational responsibilities. An installer cannot determine the purpose of processing, the region of every recipient, or the policies of every destination. Teams should run a data-flow review before production access and repeat it when sources, permissions, regions, or outputs change.

A fact ledger for company and contact data, credentials, and review controls

Data behavior table

Evidence checklist

Inspect the command in a controlled environment