How Gather Sprout protects workspaces.

Workspace operators sign in with email and password, or with Google and Apple OAuth where enabled for the deployment. Account verification uses an emailed token with the configured expiry. Password-reset and email-change tokens are capped at one hour.

Organisations use memberships with roles. Invitations can add teammates with a chosen role. Authenticated console routes are not indexed for search.

Organisations can create scoped API keys for programmatic access. Outbound webhook endpoints support signed deliveries so receivers can verify authenticity. Settings shows key and endpoint creation plus current status; full lifecycle operations are available through the management API.

Public form configuration and submission endpoints apply rate limits, allowed-origin controls, field validation, honeypots, consent snapshots, and idempotency keys where applicable. Already-subscribed addresses are accepted without mutating the verified profile or attaching new provenance.

Form and public API captures use double opt-in, so unconfirmed contacts remain pending and cannot become subscribed until they confirm. Unsubscribe, bounce, and complaint handling create durable suppressions. Sensitive identifiers used for suppression matching are stored as HMAC hashes rather than raw email where the privacy path requires it.

The public site ships with HTTPS-oriented security headers including Content-Security-Policy, HSTS, X-Content-Type-Options, Referrer-Policy, and frame protections. Features available in your workspace still depend on how your deployment is operated.

Email security and privacy concerns to [email protected]. Related policies: Privacy and Terms.

No subprocessors list, data-centre map, retention schedule, SOC 2 badge, or pentest report is published here. Ask [email protected] for operator-specific details that apply to your instance.