Security

Baseline changes configuration in many client accounts at once, so it's built to make a mistake hard to make and easy to undo.

Safety rules every change follows

• A dry run of every account before any change; nothing runs until someone approves that exact dry run.
• Changes that archive, delete, overwrite or remove access need the approver to type the number of accounts affected.
• A copy of each account's configuration is saved before the first write to it, so every run can be rolled back.
• Deletes are soft by default: renamed and archived, never destroyed, unless you choose a permanent delete separately.
• If an account changed after the dry run, that item is skipped, never overwritten blind.
• A write that fails or times out is never simply repeated: the account is re-read first, so nothing is created twice.
• Only one change set writes to an account's items at a time.
• Protected accounts can never be changed, on any path. Daily and per-run limits cap how much can change.
• Every action is in an activity log: who, what, when, which accounts.

Data protection

• CRM access tokens are encrypted at rest with AES-256-GCM. Everything travels over HTTPS.
• Each agency's data is kept separate: every query and every stored file is scoped to the agency.
• We never read contacts, conversations or messages. Logs are scrubbed of tokens and email addresses.
• Webhooks from the CRM are signature-checked. Public endpoints are rate-limited.
• Inside your CRM, Baseline signs you in with the CRM's own signed user context; roles decide who can look, build and approve.

Reporting a problem

Found a security issue? Email hello@goldstandardweb.com with "Security" in the subject. We reply within 24 hours.