Inquiry-specific reply addresses route customer replies back to the matching inquiry.
SECURITY & TRUST
Trust should come from
how the system behaves.
Followary handles customer inquiries, replies and follow-up state. That makes access boundaries, stopping rules and predictable sending behavior part of the product — not an afterthought.
Operated by Marteinn Hilmarsson, Iceland. No third-party security certification is claimed.
Workspace data is separated at the data layer.
Followary is multi-tenant. Access to workspace records is enforced with workspace membership checks and PostgreSQL Row Level Security rather than relying only on what the browser interface hides.
Cross-workspace isolation has been tested using an authenticated non-member context to confirm that tenant-readable tables do not return another workspace’s records.
Authentication stays scoped.
The private-test browser client uses a publishable Supabase key and a user-scoped bearer token. Privileged service credentials are not placed in browser code.
The normal private-test workspace session is kept in page memory rather than localStorage. One-time invitation and password-recovery access tokens may be kept only in the current tab’s sessionStorage for up to 30 minutes so a refresh does not invalidate an already verified secure link; they are cleared after completion or expiry. Supabase leaked-password protection is enabled for email-password accounts.
Email automation has brakes.
Replies, opt-outs and closed inquiries stop later follow-up work.
Bounces, failures, suppressions and complaints are tracked before more email is attempted.
Draft-only and approval-required controls exist before any broader automatic sending mode.
The sending domain and receiving domain used in private testing are verified. Broad automatic production sending remains intentionally controlled during the first external pilot.
Billing credentials stay server-side.
Lemon Squeezy checkout creation uses server-side credentials. Subscription events are received through signed webhooks and synchronized to workspace billing state. API secrets and webhook signing secrets are not embedded in the public browser client.
The current $99/month checkout is test-only and is not finalized public pricing.
The browser gets only what it needs.
The private workspace is marked noindex/nofollow and served with a restrictive Content Security Policy. Browser network access is limited to the configured Supabase project; direct Resend or Lemon Squeezy secret credentials are not exposed in front-end code.
Recovery evidence has a defined scope.
An isolated restore test recovered selected application data, user-to-workspace relationships and schema metadata. It did not restore a Supabase-managed daily backup and did not include password hashes, sessions or provider secrets. Managed-backup availability and full recovery verification remain pending.
Current security boundaries.
- Followary is still private early access, not a certified enterprise security product.
- No SOC 2, ISO 27001, penetration-test certification or similar third-party assurance is claimed.
- Public signup remains closed. Password recovery, fresh team invitation and leaked-password protection have completed their recorded private-test acceptance checks.
- Automatic production email is not broadly enabled for the first external pilot.
- Workspace export, guarded deletion requests and a service-only emergency containment control are deployed. The inactive-workspace retention rule, permanent privacy/security contact and remaining business disclosures are still being finalized.
- All current public/private application base tables have Row Level Security enabled, with explicit client-denial controls on private operational tables.
Security reports during private testing
Invited testers should use the same private contact channel through which access was arranged and mark the message as a security issue. Do not send passwords, secure-link tokens or unnecessary customer data. See the Contact page for the current arrangements.