CASA Tier 2, assessed by TAC Security
Before an app can read Gmail data, Google requires an independent security review. Medialyst passed it.
- 01Self-assessment questionnaire, reviewed by the lab
- 02Application security scan
- 03Encryption evidence
Medialyst is CASA Tier 2 compliant, verified by TAC Security. Connected credentials and Gmail OAuth tokens are encrypted with AES-256-GCM, and API tokens are stored only as hashes. Customer data is scoped per organization, with Postgres RLS on sensitive tables. Zero data retention is on across every AI provider, and we don't train Medialyst-owned models on customer data. All traffic runs over HTTPS, and database connections use SSL.
Talk to us at [email protected] before procurement. We'll meet you in the middle on most enterprise asks.
Security controls in place
- CASA Tier 2
Independently assessed by TAC Security, an ADA-authorized CASA lab.
- Verified Gmail scopes
Google approved our restricted Gmail scopes in September 2026.
- AES-256-GCM encryption
Connected credentials and Gmail OAuth tokens are encrypted at the application layer.
- Hashed API tokens
Raw token values are never persisted after issuance.
- Org scoping + Postgres RLS
Sensitive routes verify org membership. RLS guards sensitive tables.
- Zero data retention for AI
ZDR is enabled across every AI provider we use.
- No training on your data
We don't train Medialyst-owned models on customer data.
- Encrypted in transit
All traffic is served over HTTPS. Database connections use SSL.
Encryption
Tenant isolation
Customer data is scoped by organization. Sensitive application routes verify that the requesting user or API key belongs to the organization before returning or mutating data. Selected high-value tables also enforce Postgres row-level security as defense-in-depth.
We keep extending org-scoping to the remaining routes and RLS to more tables. Progress is tracked on the roadmap below.
Authentication
AI providers
Product AI calls (campaign analysis, workflow automation, table operations, journalist/contact classification) route primarily through OpenRouter, which fronts models from Google, Anthropic, and OpenAI. Embeddings and a small set of internal tooling call OpenAI directly.
User prompts, campaign material, scraped company content, workflow rows, journalist names and publication context, contact values, and generated outreach.
PII
PII handled: user names and emails, organization metadata, journalist contact data, media-list/workflow data, connected-account metadata, email-send metadata, campaign content, and operational logs.
Some AI workflows process PII when it's part of the customer prompt, campaign material, or workflow row being analyzed. We redact selected sensitive tokens from operational logs; we don't run automatic PII redaction before every AI call.
Data retention & deletion
Users and organization owners can initiate account or organization deletion. Org-scoped database records cascade on org deletion; user deletion removes the user from marketing audiences and cancels subscriptions.
Backup retention and vendor-side deletion windows vary by subprocessor and will be confirmed in writing for any customer that needs a specific guarantee in their contract.
Audit logging
We log public API requests, OAuth token issuance, connected email-send events, workflow failures, and application errors. We use these logs for debugging, abuse investigation, and operational support. Customer-facing audit-log export is on the roadmap.
Subprocessors
Current as of October 9, 2026. Updated when we add or remove vendors.
| Vendor | Purpose | Region |
|---|---|---|
| Vercel | Web hosting + serverless runtime | US (default) |
| Supabase / Postgres | Application database | Confirmed on request |
| Cloudflare R2 | File / object storage (S3-compatible) | Provider-managed |
| Trigger.dev | Background workflow orchestration | US |
| OpenRouter | AI model gateway (Anthropic, Google, OpenAI) | Provider-managed |
| OpenAI | Direct: embeddings on customer content | US |
| Stripe | Billing | US / EU |
| Loops | Product email | US |
| Resend | Transactional email | US |
| Sentry | Error monitoring | US / EU options |
| PostHog | Product analytics | US / EU options |
| Google Gmail API | Optional customer-connected sending + reply tracking | Customer-controlled |
| Microsoft Graph / Outlook | Optional customer-connected sending | Customer-controlled |
| Instantly, Reply.io | Optional customer-connected outreach | Provider-managed |
Roadmap
In rough priority order, without committed dates. A control only moves up this page once it's live.
- 1Enforced MFA and passkeys at the organization-policy level.
- 2Org-scoping audit across the remaining product routes, with RLS on more tables.
- 3Per-provider ZDR attestations and DPAs, published for download.
- 4Published region commitments for the production database and storage, as the first step to contractual region pinning.
- 5A published incident-response runbook and customer notification SLA.
- 6Customer-facing audit-log export.
- 7SOC 2 Type 1 readiness assessment.
Need one of these in place for procurement? Email [email protected] and we'll scope it with you.
Reporting a vulnerability
Email [email protected]. Include: