Security
What Sellinger does to protect your data
Sellinger holds your leads, your conversations and the connections to your LinkedIn, email and messaging accounts. This page lists what we do to protect them and where each statement is made, so you can check it.
It makes no certification claims, and it says plainly when a protection comes from a provider we use.
Reviewed on 19 October 2026.
Where your data lives
Database, sign in and file storage on Supabase (Amazon Web Services, Stockholm). Application servers and background workers on Google Cloud (Finland). Web hosting on Vercel. The full list of sub-processors, what each one does and where it processes data is in section 7 of the Privacy Policy.
What we state, and where
Each row is a statement we make, with the document or behavior that backs it.
| Statement | Where it is stated or enforced |
|---|---|
| Our main database and servers are in the European Union. | Privacy Policy, section 8, and DPA, Annex 2. |
| LinkedIn, mailbox, WhatsApp and Instagram connections run through a hosted login by our provider Unipile. We do not store your platform passwords. Disconnecting an account stops further access. | Privacy Policy, section 6.1, and the connect flows in the app. |
| Customer workspaces are separated with database row level security. Access to production systems is role based and limited to people who need it. | DPA, Annex 2, and Privacy Policy, section 11. |
| Data is encrypted in transit with TLS. Databases, file storage and backups are encrypted at rest by our hosting providers. | DPA, Annex 2, and Privacy Policy, section 11. |
| API keys are stored only as SHA-256 hashes. They can be revoked or set to expire, and they carry per minute and per day limits. | Product behavior, checked in the code on 19 October 2026. |
| You can sign in with email, Google or Microsoft. Single sign on by company domain is available on request for Enterprise. | DPA, Annex 2, and the pricing page. |
| The database has automated backups with point in time recovery. Application and worker services have error monitoring, health checks and alerting. Production changes are version controlled and can be rolled back. | DPA, Annex 2. |
| Access to the API and to AI assistant connectors is logged. Secrets and API keys are kept outside source code. | DPA, Annex 2. |
| We do not use customer data or output to train AI models, ours or anyone else's. | Privacy Policy, section 5, and Terms, section 10. |
Deleting data and erasing a person
After the service ends, you can export your data for 30 days. We then delete or irreversibly anonymize it within 60 days, including in backups as they rotate, unless the law requires us to keep it (DPA, section 11). Retention for each kind of data is in section 9 of the Privacy Policy.
An erasure function takes an email address, phone number or LinkedIn address, anonymizes the matching leads in the workspace and adds the identifiers to the suppression list so the person cannot be imported and contacted again.
If something goes wrong
We notify a customer without undue delay after becoming aware of a personal data breach that affects their data, and where feasible within 48 hours (DPA, section 9). Where a breach is likely to result in a risk to individuals, we notify the competent authority within 72 hours (Privacy Policy, section 11). To report a security concern, write to hello@sellinger.ai.
What this page does not claim
No system is completely secure. This page makes no claim of an audit, a certification or a penetration test report, and it lists only statements we can point to. Platforms such as LinkedIn may limit or restrict an account that uses automation; the Terms explain who carries that risk, and the outreach rules page lists the limits and stops the product enforces.
If a statement here looks wrong or out of date, write to hello@sellinger.ai and we will check it.
