Tenant isolation
Campaigns, contacts, delivery connections, branding and reporting resources are associated with tenant and workspace scope.
CloudRevolREACH
SECURITY & GOVERNANCESaaS boundaries are part of
the application architecture.
Reach is designed around tenant scope, workspace authorization, protected provider credentials and backend enforcement.
✓Tenant isolation✓Server-side authorization✓Auditable administration
Workspace protectedServer-side authorization
Workspace permissions and plan restrictions are checked by backend APIs instead of relying only on browser controls.
Encrypted provider credentials
Delivery credentials and OAuth refresh tokens are stored encrypted rather than exposed to the browser.
Controlled subscription fallback
A frozen or expired subscription can fall back to Restricted effective limits while preserving the purchased plan and customer data.
Protected platform administration
Platform Super Owners remain outside normal tenant membership rows and use separate platform-wide authorization.
Auditable administration
Administrative membership, plan and platform actions can be written to PostgreSQL audit history.
Provider access stays purpose-specific.
Reach uses the permissions needed for configured delivery operations. Delegated provider connections are designed around delivery rather than unnecessary mailbox access.