Security
Your keys are the crown jewels.
Outmove holds the credentials that run your business: Stripe, your CRM, your chat. We built the whole product around one rule. A key that comes in never comes back out.
Envelope encryption
What happens when you paste a key
Credentials are encrypted before they ever touch the database, with AES-256-GCM and a unique data key per secret. One auditable module owns every encrypt and decrypt.
01
Encrypted on arrival
Your key is encrypted with a fresh AES-256-GCM data key the moment it reaches the server. The plaintext is never written anywhere.
02
The data key is wrapped
That data key is itself encrypted by a master key that lives only in the server environment. Not in the database, not in the client, not in git.
03
Decrypted only at call time
Keys are decrypted inside a server-side adapter for the one call that needs them, then gone. Never logged, never cached, never sent to a browser.
In practice
The rest of the perimeter
Write-only credentials
You can save or replace a key, but nothing can read one back. The UI shows only a label and the last 4 characters, and no API route returns a decrypted credential. Ever.
Tenant isolation, default deny
Every table carries your workspace id and row-level security denies everything by default. Cross-tenant access is treated as a highest-severity bug, with tests that try it on every release.
Append-only audit log
Every credential save, replace, and delete, and every provisioning action is recorded with a timestamp. Entries are insert-only, so history can't be rewritten.
OAuth-first, least privilege
Wherever a provider supports OAuth, that's the primary path: scoped, revocable tokens instead of pasted keys. Where a key is unavoidable, the connect guide walks you through creating a restricted one.
Signature-verified webhooks
Inbound webhooks are verified against their signing secret. Anything that fails verification is rejected and logged, never processed.
Rate limits + unguessable links
Public pages (signing, payment, client hub) are scoped by 144-bit random tokens and rate-limited. Client sessions on the hub are verified by emailed codes.
Two-factor authentication
TOTP two-factor is built in for every account, no paid tier required. Your workspace is only as safe as its logins.
Hardened by default
Strict Content-Security-Policy, HSTS, and frame-ancestors none on the app. TLS in transit, encrypted at rest, and encrypted backups through our infrastructure providers.
The hard lines
What we never do
These aren't policies, they're enforced in code and checked in CI on every release, including automated tests that try to read credentials back and probe cross-tenant access.
- ✕Return a decrypted credential from any API, to anyone, for any reason
- ✕Log key material, or include it in error messages or analytics
- ✕Put credentials in webhook payloads or client-side code
- ✕Store the master key in the database, in the client bundle, or in git
Found something?
Security reports get priority over everything else. Reach us through the Feedback button in the app, or reply to any email you've received from Outmove, and we'll respond fast.
See it run
Watch a close go
from yes to onboarded.
The demo runs the whole flow on a sample client: fill the form, sign, pay, and watch the workspace, channel, files, and kickoff email provision themselves. No account needed.
Provisioning kicks off
Illustrative product data, not customer results