Security & Compliance

Cold Agent is built with security at its foundation. We follow industry best practices and are actively pursuing SOC 2 Type I certification to provide our customers with independently verified assurance of our security controls.

SOC 2 Trust Service Criteria

Security

We protect customer data through defense-in-depth controls across every layer of the stack.

Production traffic is served over HTTPS with modern TLS configuration at the edge
The application API scopes workspace data by tenant before handlers execute tenant-owned operations
Administrative server access is restricted to key-based SSH and hardened with firewall rules
Content Security Policy (CSP) headers enforced on all endpoints to prevent XSS and injection attacks
Automated build and deploy checks run before production services are restarted

Availability

Our infrastructure is designed for high availability and resilience, targeting 99.9% uptime.

The Go API and React web app run as managed systemd services with restartable units
Health checks are part of the GitHub Actions deployment workflow
Postgres-backed durable job patterns are used for long-running work that must survive restarts
Background schedulers recover stale running work instead of relying only on request goroutines
Manual emergency restart procedures are documented for production service recovery

Confidentiality

Customer data is isolated and protected through strict access controls and encryption boundaries.

Tenant data access is scoped by tenant_id throughout authenticated API handlers
Authentication is handled through AWS Cognito JWT validation in backend middleware
Role-based checks are applied through authenticated request context
Sensitive production configuration is deployed through GitHub secrets and the managed environment file
Production credentials are not committed to the repository

Processing Integrity

We ensure data is processed completely, accurately, and in a timely manner.

Durable Postgres-backed jobs persist work before expensive AI, import, verification, or sync operations run
Workers lease jobs, checkpoint item progress, and recover stale running work after deploys or restarts
Automated retry with exponential backoff for transient failures
Tenant-scoped database operations protect campaign, lead, and sender state from cross-workspace leakage
End-to-end audit trail for email sends, lead updates, and campaign state transitions

Privacy

We respect user privacy and comply with global data protection regulations.

GDPR-compliant data export and deletion workflows — request via Settings or email
Data Processing Agreement (DPA) is available publicly on the website
Data minimization — we collect only what is necessary to provide the Service
Reply monitoring uses user-authorized Gmail OAuth scopes rather than asking for mailbox passwords
Suppression and unsubscribe workflows are part of the cold outreach operating model

Infrastructure

Cold Agent's current production stack is a Go API, React Router frontend, and Postgres database deployed through GitHub Actions to managed Linux services. AWS remains part of the product where it is actually used, including Cognito authentication and SES-backed sending paths.

Access Controls

Authentication is handled through Amazon Cognito with support for email/password and social login. The backend validates Cognito JWTs, extracts tenant and role claims, and scopes API work to the authenticated tenant context before tenant data is returned or mutated.

Data Protection

Cold Agent stores operational application data in Postgres and keeps production secrets out of source control. Email credentials, API keys, OAuth tokens, campaign data, and lead data are treated as tenant-scoped data and accessed through authenticated server-side paths.

Incident Response

We maintain documented production recovery steps, health checks, and service restart procedures. Critical operational issues are investigated from deployment logs, service logs, database state, and application-level audit trails before remediation is shipped.

Compliance Certifications

Cold Agent is currently undergoing SOC 2 Type I audit preparation. We have implemented controls aligned with the AICPA Trust Services Criteria across all five categories: Security, Availability, Confidentiality, Processing Integrity, and Privacy. Our target completion date is Q3 2026. Upon completion, the SOC 2 report will be available to customers and prospects under NDA.

Questions?

For security inquiries, vulnerability reports, or to request our SOC 2 readiness documentation, contact our security team at security@getcoldagent.com. We respond to all security-related inquiries within one business day.