Security

CraftMyFunnel uses authentication controls, role-based and team-based access checks, encrypted secret storage where applicable, and operational safeguards to protect connected accounts and application data.

Connected integrations should use least-privilege OAuth scopes. For Gmail send-only mailbox connection, the application should request only the access needed to send user-approved emails.

OAuth tokens, refresh tokens, SMTP passwords, and credentials should not be exposed in frontend code, public logs, analytics tools, or support screenshots.

Users should only connect Google Workspace accounts, Gmail mailboxes, domains, and sender identities they own or are authorized to use.

To report a security concern, contact support@craftmyfunnel.live.