Security & compliance
Built to protect your customers — and your business
Messaging compliance is enforced server-side on every send, whether it comes from a person, an automation or the AI. And your workspace data stays isolated, permissioned and audited.
Messaging compliance
Guardrails on every message and call
Consent per channel
Email, SMS, WhatsApp and call consent is tracked separately on every lead and contact, with its source, the consent wording as evidence and the IP address for web forms.
STOP, START and HELP
Opt-out keywords revoke consent automatically and reply with a confirmation. START resubscribes; HELP returns your business name and opt-out instructions.
Quiet hours
SMS and calls are not placed during your workspace's quiet hours in the recipient's time zone. Automated messages wait until the window opens.
WhatsApp rules
WhatsApp requires opt-in, and outside the 24-hour customer service window only approved templates can be sent.
Email unsubscribes
Unsubscribed recipients are excluded from email sends, including automations.
Call consent
Outbound AI calls require call consent and respect do-not-call flags on the record.
Exa provides tools that support compliant messaging, but you remain responsible for how you contact people and for meeting the laws that apply to you (such as the TCPA, CAN-SPAM and carrier requirements). Read our guide to TCPA-friendly texting.
Platform security
Your data, isolated and accountable
Role-based access control
Owner, admin, manager, rep and viewer roles map to granular permissions such as export, import, messaging, automations, settings and AI actions.
Record visibility
Reps see records they own or that are unassigned. Managers and admins see the whole workspace.
Tenant isolation
Every record belongs to a workspace and every query is scoped to it. Requests for records in another workspace return not found.
Audit logs
Creates, updates and deletes are recorded with old and new values, the user, IP address and user agent. Secrets are never logged.
Encryption of secrets
Integration credentials, calendar tokens and webhook secrets are encrypted at rest. API keys are stored as SHA-256 hashes and shown only once.
Verified webhooks
Inbound provider webhooks are verified (Twilio signatures, Meta signatures, Vapi shared secrets, secret URL tokens). Outgoing webhooks are HMAC-signed.
Rate limiting
Authentication, API, AI, public form and integration endpoints are rate limited to protect against abuse.
AI with guardrails
The assistant only uses tools you have permission for, and every change it proposes waits for confirmation.
Questions?
Security reviews and questionnaires
Need more detail for a vendor review? Email [email protected] or book a call and we'll walk you through it.
Close more deals with less busywork
Set up your workspace in minutes, import your leads from a CSV and let Exa handle the follow-up.