Trust should be specific.
How Blendwave controls access, protects customer data, and welcomes scrutiny.
Access stays scoped.
People and integrations get a defined path into each workspace.
Workspace access
Requests are scoped to the signed-in workspace and checked against server-owned permissions. Database row policies add another boundary where they apply.
Sign-in
Supabase Auth supports password and email-link sign-in. Owners and admins can be required to use TOTP two-factor authentication.
Verified webhooks
Supported Telnyx and Resend webhooks are signature-checked. Blendwave-generated webhooks carry an HMAC-SHA256 signature recipients can verify.
Data is handled with care.
Protection continues through storage, operational records, and data requests.
Encryption
HTTPS protects traffic in transit. Integration credentials handled by the credential service are encrypted with AES-256-GCM before storage.
Activity records
Audited operator workflows leave structured events in a hash-chained log. Ask for the current event-coverage matrix when assessing a control.
Your data
Workspace admins can request export or deletion. Customer conversations are not used to train a shared Blendwave model.
Current assurance scope.
These practices describe the product today, but deployment varies by environment. Blendwave does not hold a formal security certification. Ask for current evidence or a security questionnaire.
Report a security issue.
Email security@blendwave.ai with steps to reproduce and a return address. Please omit secrets and customer data. We prioritize reports by severity and credit reporters in release notes with permission.
See the subprocessor list and privacy policy.