Home / Security & trust

Built to protect your domain and your reputation

Winnow is aggressive on pipeline and careful with your name. Governance is not a setting you turn on, it is how the platform works by default.

Human approval gate

No message sends without a person explicitly approving it. The preview is byte-for-byte what goes out, so there are no surprises at send time.

Suppression and never-contact

Suppression lists are enforced before a message is even composed. Add anyone to never-contact and Winnow will not reach them, ever.

One-click unsubscribe

Every live send carries compliant unsubscribe headers and a footer link. Opt-outs flow straight back into suppression.

Grounding guardrails

Generated claims are scored for factual grounding and labeled by source. Unsupported claims are flagged before you approve a send.

Full audit trail

Every run, reveal, and send is logged with cost, usage, and the user who performed it. Nothing happens off the record.

Privacy-first data model

Contacts carry a lawful-basis and retention policy. Sensitive details stay masked until you choose to reveal them.

Data and access

Your workspace, your control

Winnow isolates each workspace and gives administrators real control over who can do what, and what it costs.

  • Tenant isolation. Each workspace's data is scoped and separated from every other.
  • Roles and permissions. Owner, admin, and member roles control who can invite, send, and manage.
  • Session security. Signed, expiring sessions, verified at the edge on every request.
  • Per-user attribution. Every action is tied to the person who took it, with usage and cost visible.
Audit log live
Campaign approved
by you · 4 touches · 128 recipients
logged
12 contacts revealed
by you · Mercury, Ramp, Deel
logged
Run completed
by you · 142 accounts scored
logged
Events
3,180
Users
4
Retention
Full
Compliance

Held to the standards your buyers expect

We treat data protection as table stakes. Here is where Winnow stands on the frameworks that matter to security and procurement teams.

SOC 2 Type II
Independent audit of our security controls.
In progress
GDPR
Lawful basis, data subject rights, and a DPA on request.
Aligned
CCPA / CPRA
Honoring access, deletion, and opt-out requests.
Aligned
CAN-SPAM
Identification, opt-out, and one-click unsubscribe on every send.
Enforced
Encryption
Data encrypted in transit and at rest.
In place
Data Processing Addendum
DPA and sub-processor list available to customers.
Available
Data minimization
Lawful-basis and retention policy on every contact record.
By default
Access controls
Role-based permissions and signed, expiring sessions.
Enforced

Building toward a certification or have a security questionnaire? Talk to us →

Transparency

You always know fact from inference

Winnow is an intelligence product, so it is explicit about where every claim comes from. Each piece of intelligence is labeled, scored, and traceable.

Verified

Drawn from live database records: firmographics, titles, work history, and verified emails.

Grounded

Read from public, first-party sources like a company's own website, and cited as such.

Inferred

AI-reasoned suggestions, clearly marked as a hypothesis to verify, never presented as fact.

Scale outbound without risking your domain

Have a security or compliance question for your team? We are happy to walk through it.

Get started → Talk to us

No pitch on the first call. Just a diagnostic.