Security & data protection

Opusend handles your prospect list, your messages, and your LinkedIn and email accounts. Here is exactly how we protect that data and keep you in control.

Where your data lives

Two simple ideas keep you in control of your own data:

The work happens in your browser. The extension reads LinkedIn, Sales Navigator, and Gmail inside your own logged-in session, on your own machine. There is no separate server logging into your accounts on your behalf.
Your CRM is your data, with a backup. The prospects, messages, and stages you save live in your workspace in a managed database, kept on an encrypted, access-controlled server backup so your pipeline is safe if a device is lost. It is your data: we store it to run the product, never sell it, never share it between customers, and you can export or delete it whenever you like.

We do not run a SOC 2 or ISO certification, and we will not claim one we do not hold. What we can tell you plainly is how the data flows and what we do with it, below.

How your data is protected

Encrypted in transit

All traffic between the extension, your browser, and our servers uses TLS (HTTPS). Nothing is sent in the clear.

Encrypted at rest

Your CRM and account data live in a managed database on encrypted disk, with automated, access-controlled backups.

Least-privilege access

Each account's data is scoped to that account. We never mix one customer's prospects with another's.

You hold the keys to send

In Assistant mode nothing goes out until a human approves it. Automation runs only within the limits you set.

What we access, and why

The extension runs only on LinkedIn, Sales Navigator, Gmail, and Opusend's own pages, never on other sites you visit. On those pages it reads what it needs to do the job you asked for:

Access	Why
LinkedIn / Sales Navigator pages	Read the prospect details you choose to save, read a conversation you open to detect replies, and run the actions you start or schedule (connect, message, follow-up).
Gmail `gmail.send` + your email address	Send the emails you compose and approve, and show which account is connected. We do not read or store your mailbox contents through the Gmail API.
Server-side AI (Anthropic)	The relevant prospect and company text is sent through our server to generate your drafts and reply suggestions. It is never used to train models.

Our use of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements.

Sub-processors

We share data only with the providers needed to run Opusend, never to sell it:

Anthropic: AI generation of drafts and reply suggestions.
Our hosting provider: runs the Opusend servers and database.
Stripe: subscriptions and payments (we never see or store full card numbers).
Our transactional email provider: delivers the account and outreach emails you send.

GDPR & compliance

Controller / processor. For the prospects you collect, you are the data controller and Opusend is your processor: we store and process that data only on your instructions.
International transfers. Some providers (including Anthropic) may process data in the United States. Where required for EEA/UK personal data, we rely on the European Commission's Standard Contractual Clauses.
Your rights. Access, correct, export, or delete your data from the product at any time, or request full account deletion, handled within 30 days of a verified request.
Data Processing Agreement. A DPA is available for business customers on request at [email protected].

Full detail is in our Privacy Policy.

Account safety on third-party platforms

Automation on LinkedIn can conflict with their terms, and platforms may restrict accounts they believe are automated. Opusend builds in daily limits, human-like pacing, and automatic stop signals to reduce that risk, but it cannot eliminate it. You stay responsible for your own accounts. See the Terms of Service.

Reporting a vulnerability

If you believe you have found a security issue, please email [email protected] with the details. We investigate every report and will keep you updated. Please give us reasonable time to fix an issue before disclosing it publicly.

Contact

Security questions: [email protected] · Privacy requests: [email protected].