Security

1. Overview

Reachmerce is a product operated by Kodensoft (kodensoft.com). In these documents, “Reachmerce,” “we,” “us,” and “our” refer to Kodensoft operating the Reachmerce services.

This page summarizes how we approach security for Reachmerce. It is informational and does not create warranties beyond the Agreement. Practices evolve as the product scales.

2. Application and access control

Workspaces are isolated multi-tenant environments. Access to CRM features requires authenticated accounts. API keys and agent credentials are stored as secrets and should be rotated by workspace admins when compromised.

3. Data in transit and at rest

Traffic to Reachmerce applications is served over TLS. Customer data is stored with our cloud providers using encryption at rest as offered by those platforms. Backups follow provider capabilities and retention policies.

4. Third-party processors

Reachmerce relies on vetted providers for core functions:

• Shopify — commerce data sync via OAuth and webhooks.
• Twilio — voice and SMS delivery; numbers and credentials are per workspace where configured.
• Stripe — subscription billing.
• Resend — transactional and marketing email where configured (including early-access audiences).
• AI model providers — conversation generation under our product configuration.

5. Logging and monitoring

We maintain application and infrastructure logs for operations, debugging, and security investigations. Access to production systems is limited to authorized personnel.

6. Vulnerability handling

If you believe you have found a security issue, email info@kodensoft.com with details and avoid public disclosure until we can investigate. Please do not access data that is not yours.

7. Customer responsibilities

Customers must protect workspace credentials, configure Twilio and email correctly, manage user seats, and use outreach features in compliance with law and the Acceptable Use Policy.