Security & data protection

Opusend handles your prospect list, your messages, and your LinkedIn and email accounts. Here is exactly how we protect that data and keep you in control.

Where your data lives

Two simple ideas keep you in control of your own data:

The work happens in your browser. The extension reads LinkedIn, Sales Navigator, and Gmail inside your own logged-in session, on your own machine. There is no separate server logging into your accounts on your behalf.
Your CRM is your data, with a backup. The prospects, messages, and stages you save live in your workspace in a managed database, kept on an encrypted, access-controlled server backup so your pipeline is safe if a device is lost. It is your data: we store it to run the product, never sell it, never share it between customers, and you can export or delete it whenever you like.

We do not run a SOC 2 or ISO certification, and we will not claim one we do not hold. What we can tell you plainly is how the data flows and what we do with it, below.

How your data is protected

Encrypted in transit

All traffic between the extension, your browser, and our servers uses TLS (HTTPS). Nothing is sent in the clear.

Encrypted at rest

Your CRM and account data live in a managed database on encrypted disk, with automated, access-controlled backups.

Least-privilege access

Each account's data is scoped to that account. We never mix one customer's prospects with another's.

You hold the keys to send

Nothing goes out until a human presses send. Automation is opt-in, and it runs only within the limits you set.

What we access, and why

The extension runs only on LinkedIn, Sales Navigator, Gmail, and Opusend's own pages, never on other sites you visit. On those pages it reads what it needs to do the job you asked for:

Access	Why
LinkedIn / Sales Navigator pages	Read the prospect details you choose to save, read a conversation you open to detect replies, and run the actions you start or schedule (connect, message, follow-up).
Gmail `gmail.send` + your email address	Send the emails you compose and approve, and show which account is connected. We do not read or store your mailbox contents through the Gmail API.
The open Gmail conversation	When you open a conversation, the extension reads that one thread in your browser to recognize the prospect and detect a reply. It reads nothing else in the mailbox, and the thread is never sent anywhere except as the context for a draft you ask for.
Server-side AI (Anthropic)	The relevant prospect and company text is sent through our server to generate your drafts and reply suggestions, together with the part of your own profile the message is written from: what you sell, your saved customer stories and materials, and your signature block. It is never used to train models.

Our use of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements.

Sub-processors

We share data only with the providers needed to run Opusend, never to sell it:

Anthropic: AI generation of drafts and reply suggestions. Each request carries the prospect and company text the draft is grounded in, and the part of your own profile it is written from (what you sell, your saved customer stories and materials, and your signature block). Never used to train models.
Cloudflare: the network in front of our site. Sees your IP address, browser and the pages you load, never your CRM data.
Google Analytics: on our marketing site (www.opusend.com) only. Never runs inside the app.
Apollo.io: work email lookup, and only when you ask for it with “Find emails”. Receives that prospect's name, employer, company domain and LinkedIn URL. We never request a personal email address or a phone number.
Our hosting provider: runs the Opusend servers and database.
Emailit: our transactional email provider, for account emails such as password resets and sign-in notices.
Lemon Squeezy: subscriptions, payments and invoicing (we never see or store full card numbers).

GDPR & compliance

Controller / processor. For the prospects you collect, you are the data controller and Opusend is your processor: we store and process that data only on your instructions.
International transfers. Some providers (including Anthropic) may process data in the United States. Where required for EEA/UK personal data, we rely on the European Commission's Standard Contractual Clauses.
Your rights. Access, correct, export, or delete your data from the product at any time, or request full account deletion, handled within 30 days of a verified request.
Data Processing Agreement. A DPA is available for business customers on request at [email protected].

Full detail is in our Privacy Policy.

Account safety on third-party platforms

Automation on LinkedIn can conflict with their terms, and platforms may restrict accounts they believe are automated. Opusend builds in daily limits, human-like pacing, and automatic stop signals to reduce that risk, but it cannot eliminate it. You stay responsible for your own accounts. See the Terms of Service.

Reporting a vulnerability

If you believe you have found a security issue, please email [email protected] with the details. We investigate every report and will keep you updated. Please give us reasonable time to fix an issue before disclosing it publicly.

Contact

Security questions: [email protected] · Privacy requests: [email protected].