Security boundaries designed around real external actions

Organization scope comes from the verified session

Authenticated product reads and writes are resolved against the user's session and active organization. Campaign identifiers and form fields are not accepted as proof of workspace access.

• Private product routes are excluded from search indexing
• Membership is checked before workspace data is returned
• Plan and credit entitlements are evaluated before provider work

Provider credentials remain server-side

Resend and Twilio connections are configured per workspace and used only by server-side delivery code. Connections are validated when saved, and missing or rejected credentials produce a visible failure instead of a shared-provider fallback.

External actions require durable state

Approval state, credit reservations, delivery jobs, suppression checks, and provider results are persisted. Atomic claims protect a delivery job from duplicate external sends when schedulers or workers retry.

Operational security is a shared responsibility

Customers remain responsible for access to their workspace and provider accounts, sender configuration, domain and phone reputation, user offboarding, and the lawful operation of their outreach. Contact VranceFlex before relying on a specific certification or regulatory requirement.