Security & Compliance
The LNA: Built for Trust
The LNA helps teams reactivate dormant leads with human-reviewed emails generated from your authorized CRM context plus public business signals. We operate with read-only CRM access, CRM-native sending, and AWS-native isolation and encryption.
ISO/IEC 27001 Aligned
GDPR Processor Read
AWS-Hosted (Private by Design)
CRM Integrations & Scopes
We request only the minimum scopes needed to read target records and to invoke your CRM’s native email send after human approval.
Purpose
Salesforce
HubSpot
Reason
Read lead/contact data
api (read objects), refresh_token
Lead, Contact, Account, prior EmailMessage
crm.objects.contacts.read, crm.schemas.contacts.read, crm.objects.companies.read, crm.schemas.companies.read, crm.objects.deals.read, crm.objects.notes.read oauth, crm.lists.read
Populate drafts with name, company, fields, stage, conversation history; filter by client-selected stages/lists.
Send approved email via CRM
Simple Email Action / sendEmail REST (within api)
Transactional Single-Send API
(transactional-email scope)
Ensure mail logs, compliance footers, opt-outs, and analytics remain governed by your CRM.
Tokens stored encrypted in AWS Secrets Manager; never in logs or front-end.
Granular queries fetch only client-designated subsets (not full CRM exports).
Opt-out safeguards re-check suppression flags before any send.
Managed Cloud Architecture & Isolation
The LNA is deployed on AWS using VPC segmentation, private subnets, and service-to-service IAM with least privilege. Each customer’s data is isolated at the database level (single-tenant schema/database on Aurora PostgreSQL).
Network Segmentation
ALB in public subnets; app services in private; database not internet-reachable; HTTPS enforced.
Data Isolation
Per-tenant database/shard. No cross-client mixing. Multi-AZ, with snapshot backups.
Secret Management
AWS Secrets Manager for DB creds and OAuth tokens; rotation and least-privilege access.
Encryption & Access Controls
Cryptography
AES-256 at rest via AWS KMS–managed keys (Aurora, S3, EBS).
TLS 1.2+ for data in transit; HTTPS enforced at the edge.
Optional application-layer encryption for select secrets (e.g., refresh tokens).
Access Control
Strict IAM roles; principle of least privilege across services.
No standing human access to client databases; privileged access is approved, time-bound, and logged.
RBAC in-app; SSO/MFA options for customer users.
Visual in progress
Compliance Impact:
Supports CAN-SPAM/CASL/GDPR
practices by honoring CRM governance and ensuring organizational oversight per message.
Responsible AI:
Private Models per Client
The LNA uses AWS Bedrock to invoke foundation models (e.g., Anthropic Claude) within AWS. Your prompts and outputs stay in AWS, not used to train global models. Each client’s model behavior is customized via private LoRA adapters and a client-specific reinforcement loop (PPO) driven by your approvals and outcomes.
Client-isolated adapters; no cross-customer training or data sharing.
Bedrock calls over secure channels; PrivateLink when available.
Continuous improvement uses your own results (reply, edits, approvals).
Human-in-the-Loop Guarantee
No message is ever sent without explicit human approval from your team. The LNA initiates CRM-native send only after you confirm.
Draft → Review/Edit → Approve → CRM send
Logged to CRM records; full audit trail
Opt-out and footer compliance preserved by CRM
Privacy & GDPR
We act as a Data Processor; you are the Controller. We process only what you authorize for the purpose of drafting and sending approved messages.
Purpose Limitation
No secondary use; no data resale; no cross-client model training.
Data Subject Rights
Export/erasure supported on request via client admin; token and tenant purge on termination.
Data Residency
Default US (us-west-2); regional deployment available to meet residency requirements.
Incident Response & Business Continuity
Incident Response
Defined IR plan: identification, containment, eradication, recovery, post-mortem.
72-hour breach notification commitment (GDPR) where applicable.
Comprehensive audit logs and forensic evidence via CloudTrail and internal logs.
Continuity & Backups
Multi-AZ Aurora; daily snapshots with retention (configurable to customer needs).
Recovery drills and tested restore procedures.
CloudFront/WAF and autoscaling patterns for resilience.
Operations Security
& Continuous Monitoring
Secure SDLC
IaC via AWS CDK, code review, SAST, container image scanning, OWASP Top 10 practices.
Logging & Threat Detection
CloudWatch, CloudTrail, VPC Flow Logs, GuardDuty, Security Hub, WAF; alerts to DevSecOps.
Change & Separation
Change management with approvals; separate dev/stage/prod; no real data in non-prod.
ISO/IEC 27001:2022 Annex A
(Condensed Mapping)
A.5 Organizational Controls
ISMS policies, roles, security training, risk assessments; cloud use policy covering AWS.
A.8 Technological Controls
Get as many sequence drafts as you need, with human approval before anything sends.
A.9 Identity & Access
Formal access control, least privilege, user lifecycle, no standing prod DB access.
A.12 Network Security
VPC, subnets, SGs, NACLs, WAF; private endpoints where available.
A.13 Incident Management
IR plan, alerting, evidence, customer notification processes.
A.14 Continuity
Multi-AZ redundancy, backups, restore tests, autoscaling policies.
A detailed control-by-control mapping is available in the downloadable PDF.
Additional Security Measures
Penetration Testing
Annual 3rd-party tests on web app, API, and cloud posture; remediation tracked.
AWS Audit Manager
Continuous evidence collection mapped to ISO Annex A; monthly reviews.
Change Management
Ticketed approvals, recorded diffs, rollout gates, rollback plans.
Documentation & Security Contact
Need the full scope, diagrams, or a completed security questionnaire?
Crafted with care by Mabbly
2026 © Mabbly, Inc. All rights reserved