Toutmark holds your customer data, your brand voice, and access tokens to your CMS. Here's what we do to keep all three safe — at the platform level, at the access-control level, and at the operational level.
Built on Cloudflare Workers, KV, D1, and R2. Every layer encrypted, every access scoped, every change logged.
All customer data — KV, D1, R2 — encrypted at rest using AES-256 (Cloudflare-managed keys). Sensitive fields (OAuth tokens, API keys) get a second envelope encryption with our application-level KV_CRYPTO_KEY stored as a Cloudflare Secret.
TLS 1.3 on every public endpoint. HSTS preloaded on toutmark.com. Internal worker-to-worker calls happen over Cloudflare's encrypted backbone. No customer data ever crosses an unencrypted hop.
OAuth tokens for customer CMS connections (WordPress, Shopify, Webflow, etc.) are stored encrypted, scoped to the minimum permissions needed, and never logged. We never see or store passwords or 2FA codes.
API keys for AI engines (Claude, GPT, Gemini, Perplexity) and integrations are injected into requests at the edge by our gateway and stripped from memory on response. Agents never receive raw keys.
Every action — agent draft, customer approval, configuration change, settings update — is recorded with timestamp, actor, and change diff. Hash-chained for tamper evidence. Exportable as JSON or CSV. Retained 90 days for all customers, 7 years for regulated.
Every customer-facing change snapshotted before publish. Per-row revert + global revert from one button. CDN cache invalidates within ~5 minutes; full revert lands within 24 hours.
Who sees what, why, and what they can do with it.
Safeguards baked into how we work, not just what we build.
Nothing publishes to your site, your social, your reviews, or any external surface without your explicit approval. Per-feature auto-publish is opt-in. Editor's compliance gate runs on every draft regardless.
If a review on G2, Capterra, or Google asks for anything not on your site (refund, custom feature, scope expansion), the response always queues for your approval — regardless of any auto-publish setting.
Agents can't delete files, modify security permissions, share documents, or initiate financial transactions on your behalf. Hard-coded in the worker. Even with a misbehaving agent, those actions structurally cannot fire.
For financial services, legal, healthcare customers: two-layer compliance review, 7-year audit retention, CCO approval queue, custom disclaimers, no cold solicitation. See regulated-firm details →
D1 (CRM) snapshotted daily to R2, retained 30 days. Hot recovery <1 hour. Cross-region replication for the production database.
Owner is paged on any worker error rate spike, sub-processor outage, or unauthorized-access alert. Customers notified within 72 hours of any confirmed breach affecting their data, per our security policy.
Where we stand on the major frameworks. We're transparent about what we do and don't have today.
Type II in progress · target 2026 Q4
Compliant · DPA available →
Compliant · privacy controls in dashboard
Available on Scale for healthcare customers · BAA on request
Regulated-mode features support recordkeeping rules · Scale tier
AI disclosure baked into every published surface
The third-party services that touch any customer data, what they do, and where they sit.
Full list with addresses + DPA references: /legal/subprocessors.
Email hello@toutmark.com — for enterprise security questionnaires, list "security review" in the subject and we'll respond within one business day.
Read full security policy →