Skip to main content
View as Markdown

Security

Lettrove is built for teams that answer to auditors. Access control, an audit trail and reviewed change management are wired in from the ground up, and the architecture is designed to make SOC 2 accreditation straightforward: the controls map to the Trust Services Criteria, and the change history is the evidence.

Access​

  • Four roles (owner, admin, editor, viewer), enforced deny-by-default on every action, in the API and the app from one catalogue so the two cannot disagree. Checks read live membership, so revoking access takes effect immediately. New teammates start with only what their role needs. Roles.
  • Workspaces are isolated. Every record belongs to one workspace, and every read and write is scoped to it.
  • Two-factor authentication is available to every account under Settings → Security.

Credentials and tokens​

  • TLS everywhere.
  • Passwords are hashed with scrypt. Session, verification and invitation tokens are stored hashed, single-use and expiring.
  • Your users, credentials and workspace membership live in Lettrove's own database, not a third-party identity vendor, which keeps the subprocessor list short.
  • Integration tokens (HubSpot's OAuth tokens) are encrypted at rest with AES-256-GCM, never shown and never logged. Secret keys for the embedded editor are kept only as a keyed fingerprint.
  • Apps you connect through the MCP server get short-lived OAuth 2.1 tokens bound to the server's address, and can be disconnected in one click.

The activity log​

Every privileged action (invites, role changes, removals, sends, integrations, keys) is recorded to an append-only log that admins review on the Activity page. The activity log.

Change management​

Every database change ships as a reviewed, committed migration. Each change to the product passes quality gates (typecheck, tests, lint, build, end-to-end tests) before it can reach production, and production is deployed from the main branch only.

Email you send​

Unsubscribe links and tracking links are signed per recipient and carry nothing personal in the address, so a link cannot be edited to act for someone else. Sending.

Questions​

Security reports and questions about your compliance requirements: support@lettrove.com.

If you embed the editor in your own product, Security for the embed and What Lettrove stores cover that side.