How we look after your inbox and your data.
Outly connects to your email and holds your lead lists, so here is exactly how that is protected, written from the code rather than a checklist. Where we haven't done something yet, we say so.
Last updated 20 October 2026
No SOC 2 or ISO 27001 certification yet. Outly has not been through an independent security audit, and we won't imply otherwise.
The practices, one by one.
Where Outly runs
The app is hosted on Vercel. Your data lives in a managed Postgres database run by Neon. Both store data on servers in the United States, as our Privacy Policy states.
Outly is operated by OriginU Technologies, Hyderabad. Vercel and Neon are the only infrastructure providers that hold your workspace data; OpenAI, Resend and the tools you connect process only what their features need, as listed in the Privacy Policy.
In transit and at rest
Every page and API call is served over HTTPS, and the app talks to the database over an encrypted connection.
The secrets that would let someone act as you elsewhere get an extra layer: Gmail and Microsoft 365 access and refresh tokens, integration API keys (such as Hunter, Apollo, HubSpot and Pipedrive) and webhook signing secrets are encrypted with AES-256-GCM before they are written to the database, each with its own random IV. The key is kept in the hosting environment, not in the database, so a copy of the database alone doesn't reveal them.
Access tokens for the MCP connector (Claude, ChatGPT, Cursor) are stored only as SHA-256 hashes, so they can't be read back even by us.
Passwords and sign-in
Passwords are hashed with bcrypt (cost factor 12). We never store or see your password in plain text.
You can also sign in with Google, or with a one-time link sent to your email, and skip the password entirely.
What we ask Google and Microsoft for, and why
Outly sends from your own inbox, so it needs permission to send and to see replies. We ask for the narrowest set that makes those features work, and Settings shows exactly what each connected account granted. Disconnect an account and our access stops immediately.
Calendar and Google Analytics access is separate and only requested if you connect them (Google Analytics is read-only).
- Gmail: gmail.send
- Send the campaign emails and replies you create in Outly.
- Gmail: gmail.readonly
- Find replies and bounce notices to emails Outly sent. Messages that aren't a reply to an Outly email are skipped and not stored.
- Google: userinfo.email, openid
- Identify which mailbox you connected.
- Microsoft: Mail.Send
- Send your campaign emails and replies.
- Microsoft: Mail.ReadWrite
- Read replies for your inbox and save AI-written replies as drafts in your mailbox. Microsoft requires this scope to create a draft; Mail.Send alone can't.
- Microsoft: User.Read, offline_access
- Identify the mailbox and keep the connection working without asking you to sign in again.
Your data stays in your workspace
Every lead, campaign, email and connection belongs to a workspace. Each request checks that you are a member of the workspace you're working in, and data is read and written scoped to that workspace. Roles (owner, admin, member) limit who can change billing and settings.
To be precise: this separation is enforced in Outly's application code, not by database-level row security.
Razorpay handles your card and UPI details
Payments go through Razorpay's own checkout. Your card number or UPI details are entered with Razorpay and never reach Outly's servers; we only receive the subscription status.
A workspace is moved onto a paid plan only when Razorpay sends a signed webhook that we verify, never because a browser said the payment worked.
Unsubscribes are honoured automatically
Campaign emails carry a one-click unsubscribe header that Gmail and Yahoo show as an Unsubscribe button. The link is signed (HMAC-SHA256), so it can't be forged to remove someone else, and opening it only shows a confirmation, so link scanners can't unsubscribe people by accident.
When someone replies asking to be removed, Outly's reply sorting catches it and stops all future campaign sends to them from that workspace.
What the AI sees
When you use AI features (writing emails, sorting replies, research, Copilot), the relevant text is sent to OpenAI's API to produce the result. OpenAI's API terms say API data isn't used to train its models by default.
Deleting your data
Email support@originutech.in from your account's address to delete your account and workspace data. We delete it within 30 days, except anything the law requires us to keep.
Anyone in a lead list who wants their data removed can write to the same address, and we'll help them reach the workspace owner or remove it.
DPDP, GDPR and certifications
Outly is run from India, and we aim to follow India's Digital Personal Data Protection Act, 2023: collecting data for a stated purpose, deleting it on request, and naming a grievance contact (support@originutech.in).
If you email people in the EU or UK, GDPR applies to that outreach. You are responsible for having a lawful basis to contact them and for honouring objections; Outly gives you the tools (unsubscribe handling, suppression, deletion on request) but doesn't make your outreach compliant for you.
We haven't been assessed against either law by a third party.
No SOC 2 or ISO 27001 certification yet. Outly has not been through an independent security audit, and we won't imply otherwise.
Report a vulnerability
Found a security problem? Email support@originutech.in with the details and steps to reproduce. The founder reads these himself.
Please give us a reasonable chance to fix it before you share it publicly, and don't access or change other people's data while testing. We don't run a paid bug bounty, but we'll credit you if you'd like.
More detail in our Privacy Policy and Terms. Live system checks are on the status page.