TJR Universe LLC, doing business as FollowArc, runs an AI-assisted sales outreach platform. This page describes the security practices we operate today. It is a plain statement of current practice and not a certification.
Data in transit and at rest
- All traffic to the app and its API uses HTTPS (TLS).
- Customer data is stored in a managed cloud database in the United States, which encrypts stored data at rest.
- Credentials we hold on your behalf, such as connected account sessions and access tokens for email, calendar and similar integrations, are additionally encrypted by FollowArc with AES-256-GCM before they are stored. The production service refuses to run without its encryption key configured.
- We do not store payment card numbers. Payments are handled by a PCI-compliant payment processor.
Access control and tenant isolation
- Every request to the API must be authenticated.
- Each customer works in a separate workspace. The server checks that the signed-in user belongs to the workspace before it returns or changes anything in it.
- Row-level security rules in the database add a second layer of protection between customers.
- Workspace roles (such as owner, admin and editor) limit what each member can do.
- Access to our administrative tools is limited to a small number of authorized platform administrators, and sensitive administrative actions are logged.
Sign-in security
- Sign in uses a managed authentication service. We do not handle or store plain-text passwords.
- Two-factor authentication with an authenticator app (time-based one-time codes) is available to every user from their profile settings. Once enabled, sign in requires the code.
Safeguards on outreach
- Daily sending limits, pacing and working hours apply per connected account, and a kill switch can stop sending immediately.
- Suppression lists and opt-outs are honored before anything is sent, and automated actions leave an audit record.
- Email messages carry the sender's postal address and an opt-out instruction, as commercial email law requires.
- Replies are never auto-sent by email. Email replies are drafted for your review.
Your data and your rights
You can export your data and request deletion of your account and data yourself from your account settings. Deletion requests include a confirmation step and a short grace period. See our Privacy Policy and Data Processing Addendum.
Service providers
We use a small number of vendors to run the service. They process data only on our instructions and under confidentiality and security obligations. See Sub-processors for the categories and what each handles.
Certifications and assurance
We do not yet hold third-party certifications such as SOC 2 or ISO/IEC 27001, and we have not published an independent penetration test report. We are glad to complete your vendor security questionnaire and to answer questions about any control described here.
Reporting a security concern
If you believe you have found a vulnerability or have a security concern, email privacy@agentsophia.com with the details. We will acknowledge your report and investigate promptly. Please give us a reasonable chance to fix an issue before disclosing it publicly.