Security, auditability, and data handling.
CortexSales is built for regulated enterprise buyers. Every action is policy-gated, every decision is logged, and the full event stream is exportable.
Audit Trail
Every send decision is logged with a correlation chain: actionId, spanId, parentSpanId, and requestId. The event log captures policy decisions, content lint scores, send/no-send verdicts, reply classifications, and outcome tracking.
Export capabilities
- JSONL export format with full correlation IDs
- Filter by campaign, date range, decision type, or outcome
- On-demand download or scheduled delivery
- Event types: policy.evaluate, outbox.enqueue, provider.send, inbound.received, case.update
Event schema (sample)
{
"actionId": "uuid-v4",
"spanId": "uuid-v4",
"event": "policy.evaluate",
"result": "ALLOW | REWRITE | TASK",
"reason": "stable-code",
"caseId": "string",
"campaignId": "string",
"timestamp": "ISO-8601"
}Control Plane
The autonomy layer separates planning from execution. Every outbound action passes through policy lint and autonomy gating before it can execute.
Shadow
AI plans and composes but nothing sends. Full audit trail generated for review.
Supervised
Every action requires human approval via the tasks inbox before execution.
Autonomous
Policy-gated sends. Graduated rollout from 5% with auto-pause on metric degradation.
Policy gates
- Content lint: 112+ spam patterns, risk score, forbidden claims
- Send policy: budget check, status check, suppression check
- Reputation guard: bounce rate < 2%, complaint rate < 0.1%
- Rate limiter: per-mailbox and per-domain daily limits
- Canary rollout: 5% → 25% → 50% → 100%
Data Handling
CortexSales processes prospect research, email content, and event logs. All data handling follows enterprise security standards.
- Encryption at rest: AES-256-GCM
- Encryption in transit: TLS 1.3
- Configurable retention periods per organization
- Automated deletion workflows for prospect data, event logs, and derived artifacts
- No sale or sharing of customer data with third parties
- PII detection and blocking in outbound content
- Secrets never logged or exposed in audit trails