# Security at Chronos > How Chronos keeps your data and sending accounts safe: encrypted credentials, official OAuth or trusted partners for every channel, per-user row-level security, and human-paced sending. Canonical: https://chronos.ro/security Last updated: 2026-11-08 ## Overview More than 3,000 users run their outreach on Chronos. They trust us with their inboxes, their LinkedIn accounts, and their campaigns, so security is built into every layer of the product, from how you sign in to how each message leaves your account. This page explains, in plain language, how we protect your data, how we connect to your channels, and how Chronos sends so your accounts stay in good standing. ## Your data is encrypted and protected - Everything travels over HTTPS. The app enforces HTTP Strict Transport Security for a full year, including subdomains, plus headers that block MIME sniffing, limit referrer data, and restrict which sites can frame the app. - OAuth tokens, API keys, and mailbox credentials are encrypted at rest with AES-256-GCM, an authenticated cipher that also detects tampering. Every value gets a fresh random IV, and the encryption key is held outside the database. - Encrypted credentials are integrity-checked on every read. If a value has been altered or cannot be decrypted, Chronos refuses to use it. - Several integrations, such as Pipedrive, Attio, Copper, Notion, and Intercom, go further and encrypt with a key derived separately for each customer. - Your campaigns, messages, and channel connections are separated by user. Those tables use Postgres row-level security, so a signed-in user can only reach their own rows, and an automated check flags new tables that do not enable it. - We never sell your data, and it is never shared for advertising. ## Built on infrastructure you already trust Chronos runs on Vercel and Railway, stores data in Supabase (Postgres), and uses AI models from Amazon Bedrock on AWS, Anthropic, and OpenAI. Service credentials live in protected environment variables, never in source code, and automated checks scan our code for known secret key formats. ## Authenticated connections to every channel Chronos connects to each channel through that platform's own sign-in or through an established integration partner. Here is exactly how each one works. - Gmail and Outlook connect through Google's and Microsoft's own OAuth sign-in screens. Chronos never asks for or receives your mailbox password. By default we ask Google only for permission to send email, and read access is requested only when you turn on features that need it, such as reply follow-ups. - LinkedIn and Instagram connect through Unipile, our messaging infrastructure partner. Your password is passed to Unipile to set up the session and is never saved in the Chronos database. For Instagram you can also sign in on a page hosted by Unipile. - Reddit and Facebook Pages connect through OAuth approval screens hosted by our partner Zernio, so you sign in on the platform itself and never give Chronos your password. Facebook Messenger, like LinkedIn, connects through Unipile, and your password is never saved in the Chronos database. - X connects through OAuth, either through Zernio or through X's own OAuth 2.0 flow with PKCE. - Substack needs no connection or credentials at all. Chronos writes your drafts and you publish them yourself. - Our OAuth connect flows use signed state, so each connection is attached only to the signed-in account that started it. - When you disconnect a channel, Chronos deletes its stored access tokens. For Gmail and X it also asks the provider to revoke the token, and for LinkedIn, Instagram, Reddit, and Facebook it removes the account from our connection partner. ## Sending that keeps your accounts safe Most accounts get flagged because a tool blasts messages at machine speed. Chronos is designed to send the way a careful person would. - Right time of day. Automated sends are checked against the send hours you set, in the campaign's timezone. A message that comes due outside those hours moves to the next open window instead of going out. - Right days of the week. Automated sends only go out on the days you choose, Monday to Friday by default. - Right amount per day. Every campaign has a daily sending limit that Chronos checks before each automated send. If LinkedIn says an account has reached its invitation limit, Chronos pauses connection requests from that account for a while. - Warm-up for new inboxes. New AgentMail inboxes start at about 10 emails a day and ramp up over roughly two weeks. Anything over the day's limit moves to a later day. - No bursts. Sends are spread evenly across your window with small random offsets, and each channel has per-minute limits, such as LinkedIn connection requests and LinkedIn messages each spaced at least one minute apart per account. - No double messages. Before every send, Chronos claims the recipient in the database and checks for earlier outreach on that channel, so a cold campaign is designed never to message the same person twice. - Stops on reply. In LinkedIn and multi-channel sequences, Chronos checks for a reply before each next step. When the prospect answers, the rest of their sequence stops so you can take over. - Account protection. Chronos stops sending from a LinkedIn account that is disconnected or restricted until it is reconnected, and automated monitors check what was actually sent, looking for duplicate LinkedIn messages every 30 minutes and for sending bursts on every channel every 5 minutes. ## Every message is researched and written for one person - Chronos writes each message with AI for that individual recipient, never from a mail-merge template. - For LinkedIn outreach, Chronos looks up the recipient's profile and recent posts before writing, so each message can point to a real detail about that person. Every message draws on the recipient's name, role, and company together with your campaign context. - Before anything is sent, Chronos checks each message for broken AI output: refusals, garbled text, unfilled placeholders, template leftovers, and, on LinkedIn, greetings addressed to the wrong person. A message that fails any check is blocked and never reaches the recipient. - If AI generation fails, the message is held back and escalated to our team. A generic template is never sent in its place. - On LinkedIn and Instagram, once the same message text has gone out three times in a campaign, Chronos blocks further copies, unless you deliberately chose to send one fixed message. - Prefer to approve everything yourself? Run a campaign in Manual mode. Chronos still writes the messages, but each first-touch message waits for you to review, edit, or delete it, and only goes out when you click send. ## Secure sign-in and APIs - Sign-in runs on Supabase Auth with signed JWT sessions and supports Google sign-in and email magic links. Login and signup endpoints are rate limited. - Our MCP server for AI agents requires a bearer token (OAuth 2.0 with PKCE, or a personal access token you create), checks the scope each tool needs, enforces per-token and per-user rate limits, keeps a redacted audit log of tool calls, and asks for explicit confirmation before sensitive write actions unless you chose to always allow that tool. - Payment webhooks from Stripe are cryptographically signature-verified with replay protection, and LinkedIn messaging webhooks must present a secret that is checked in constant time. - Errors are tracked centrally with severity levels, and high-severity issues alert our team automatically. ## You stay in control of your data You can permanently delete your account at any time. Chronos stops your outreach, cancels billing, disconnects every linked provider, and deletes your account's data and login, with every delete restricted to your account. Deletion requires you to be signed in, type a confirmation, and re-enter your account email. For details on what we collect and why, read our privacy policy at https://chronos.ro/privacy. ## Contact Security question, or found something you want to report? Email nadav@chronos.ro and we will get back to you directly. ## Frequently Asked Questions ### Is Chronos secure? Yes. Chronos serves everything over HTTPS with HSTS, encrypts stored OAuth tokens and mailbox credentials with AES-256-GCM, keeps your campaigns, messages, and channel connections separated by user with Postgres row-level security, and connects to channels through official OAuth sign-in or established integration partners. ### Does Chronos store my Gmail or LinkedIn password? No. Gmail and Outlook connect through Google's and Microsoft's own OAuth screens, so Chronos never receives your mailbox password. Your LinkedIn password is passed to our messaging partner Unipile to set up the session and is never saved in the Chronos database. ### Will Chronos get my LinkedIn or email account flagged? Chronos is designed to keep your accounts in good standing by sending the way a careful person would: automated sends go out only in your send hours and on your chosen days, within daily limits, spread evenly with per-minute caps, with a warm-up ramp for new inboxes, and with every message written for one specific person. ### Are Chronos messages templates? No. Chronos writes each message with AI for that individual recipient. If AI generation fails, the message is held back and never replaced by a generic template, and quality checks block broken output before it is sent. ### Does Chronos sell my data? No. Chronos never sells your data and never shares it for advertising. ### How do I delete my data? You can permanently delete your account from Chronos at any time. Deletion stops outreach, cancels billing, disconnects linked providers, and deletes your account data and login. You can also email nadav@chronos.ro.