EngageYour workspace, your mailboxes, kept apart
How Engage protects your account, your connected mailboxes and the leads you upload.
Isolated organisations
Every record belongs to one organisation. Reads and writes are scoped to the signed-in organisation at the data layer, and internal ids never appear in URLs.
Encrypted mailbox access
Mailboxes connect with Google sign-in (OAuth). Engage never sees your Google password, and the access tokens are encrypted at rest.
Two-factor sign-in
Users can turn on authenticator-app codes. The 2FA secret is encrypted at rest, and code attempts are rate-limited.
Roles and permissions
Each user has a role built from individual permissions. Buttons, pages and API access all follow the same check, on every request.
Scoped API tokens
API tokens carry only the permissions you choose, can expire or be revoked at any time, are rate-limited, and are stored only as a hash.
Activity log
Sign-ins and changes to campaigns, mailboxes, users and settings are recorded with who did what and when.
More detail
- Passwords are stored as one-way hashes. Sign-in, password reset and the contact form are rate-limited and can be protected with reCAPTCHA.
- Web protections: CSRF tokens on every form and standard security response headers.
- Tracking links for opens and clicks are signed, so they cannot be altered to point somewhere else. You can serve them from your own tracking domain.
- Suppression of unsubscribes, hard bounces and do-not-contact entries is enforced before every send, in every campaign.
- Suspension: a suspended organisation cannot sign in, its sessions end on the next request and its campaigns stop sending.
- Session ids are never stored in audit records; only a hash is kept.
Reporting a vulnerability
If you believe you have found a security issue, please tell us through the contact form. Please do not access other customers' data or disrupt the service while testing.
Last updated 24 October 2026.
See Engage with your own sending setup
Book a short demo. We will connect a mailbox, check your timing and walk through replies and the pipeline with you.