How is each customer's data kept separate?
Each workspace's data is kept apart by Postgres row-level security, enforced in the database on every public table and on file storage. A user sees their own workspace's data, and the database checks every request, including a direct API call.
- Tenant isolation is enforced in Postgres, not just hidden in the interface.
- Row-level security covers every public table and file storage.
- Roles are set per workspace, so the same person can be an Administrator in one workspace and a Standard user in another.
- An SSO email domain can belong to one workspace, so a domain never maps to two workspaces.
- Routeability staff never see survey answers or comments. Logged customer email content goes into an export when a member of your workspace runs it, and Routeability staff don't receive it.
How do people sign in (SSO and MFA)?
Every paid plan includes per-workspace SAML SSO with just-in-time provisioning, and MFA is required. Teams sign in through their own identity provider or with a password plus an authenticator code.
- SAML SSO works with any SAML 2.0 identity provider, such as Okta, Microsoft Entra ID, Google Workspace and OneLogin.
- Email domains are proven by DNS TXT records before SSO is enabled.
- New people join on their SSO sign-in with the role the admin chooses: Standard, Financial or Admin.
- Password sign-ins need a 6-digit authenticator code on every paid plan. SSO users sign in through their identity provider, under whatever MFA it enforces.
- Email-and-password sign-in stays available as a protected break-glass path, still requiring MFA.
- The Routeability admin console always requires MFA.
Who can see and change what?
Every person has one of three roles (Standard, Financial or Administrator), and the database checks the role on every request, even a direct API call. Roles decide who sees financial screens and who can change configuration.
- Standard: full day-to-day work on customers and pipeline.
- Financial: adds financial targets and recording renewals, plus the Sales analytics tab on plans with advanced analytics.
- Administrator: full workspace access, including configuration and user management.
- Every change to ARR is a ledger movement, booked through controlled actions and recorded in the audit log. Nobody types over ACV.
- Raising an AI agent's autonomy level always needs MFA.
What is logged?
Routeability keeps a field-level audit log by default: who changed what and when, with before and after values, written by the database. The log outlives the records it describes, so deleting a customer does not erase its history.
- Each entry shows the action (insert, update or delete), the record, the field-level before and after values, and who made the change.
- Every AI approval, edit, dismissal and level change is written to the audit log. Level changes, holds and automatic step-downs are recorded with who made them and why.
- Every email an agent queues, and every email a person stops, is recorded.
- Workspace data exports are recorded in the audit log.
- Workspace admins view the log under Settings, Data & Compliance, Audit Log.
How does the AI handle my data and who approves its actions?
On Scale, Enterprise and trials, AI agents draft the work and a person makes the call: every action starts at Draft and approve, and the platform enforces a ceiling on how far each action can go. Money, pricing, proposals and contracts always need a person.
- Agents draft renewal, retention, expansion and EBR prep work into one Triage queue, ranked by the revenue at stake.
- Admins set how far each agent may go, action by action, up to a ceiling set by the platform.
- Raising a level needs MFA. Act with a hold and above also need a track record: 20 reviews in the last 90 days, with 95% approved without edits.
- An action steps back down by itself if its approval rate drops.
- Money and the ledger, pricing and discounts, proposals and contracts, renewal outcomes, the forecast, deletion and access always need a person.
- Some AI features use a third-party AI provider, Anthropic, to draft or analyse content. The relevant inputs are sent to the provider to generate output, which returns to Routeability for your review.
- AI Assist chats are not saved: closing AI Assist clears the conversation.
How is data encrypted and where is it hosted?
Data is encrypted in transit, and sensitive connection secrets such as mailbox connection tokens and Slack webhook URLs are stored encrypted. The application database, authentication and file storage are hosted in the USA (us-east-1).
- Data is encrypted in transit.
- Mailbox connection tokens are encrypted and stay on the server.
- Slack webhook URLs are stored encrypted, never shown in full again after saving (just the last four characters), and never written to logs or the audit log.
- Where personal data is transferred internationally, Routeability relies on appropriate safeguards such as standard contractual clauses.
What happens to my data if I leave?
Admins can export the workspace's personal data as JSON from Settings, and under the privacy policy, after termination you may export Customer Data for a reasonable period. After that period it may be deleted or anonymized.
- Export workspace data downloads a structured JSON copy of the personal data held in the workspace, including the audit log.
- Admins can export or erase one person by email to answer access, portability and erasure requests.
- Erasure anonymises in place, so account and financial history stay intact, and it also redacts the person from the audit log and saved snapshots.
- Nightly automatic workspace snapshots are kept for 30 days, plus manual snapshots before a big import, restorable by account admins.
- Routeability does not sell personal data.
Which security standards is Routeability built to?
Routeability is built to SOC 2 and ISO 27001 controls. The controls a security review asks for are part of the product on every paid plan, not an upgrade.
- Tenant isolation enforced in Postgres.
- SAML SSO and MFA on every paid plan.
- Standard, Financial and Administrator roles enforced by the database.
- A field-level audit log by default that outlives deleted records.
- GDPR export and erasure built into Settings.
How do I start a security review?
Email hello@routeability.com for a security review. Tell us about your organization and what your review covers.
- Privacy requests and enterprise enquiries go to hello@routeability.com.
- Our privacy policy at routeability.com/privacy explains how personal data is collected, used, shared and protected.