Security at Marvelous

Marvelous handles executive rosters, meeting notes, and CRM data for revenue teams. That means we take security seriously, and we build the platform on top of infrastructure that does the same. This page describes what is enabled today.

1. Infrastructure

Marvelous runs on Cloudflare (edge compute and CDN) and Supabase / Postgres (application database, authentication, and file storage). Both providers hold SOC 2 Type II reports, which we review annually.

Application traffic is served over TLS 1.2 or higher. HTTP requests are redirected to HTTPS at the edge. Data at rest is encrypted using AES-256 by our infrastructure providers.

2. Authentication

Sign-in is passwordless. Users authenticate through Google OAuth or a one-time email code. Sessions are stored in httpOnly cookies with SameSite protection. There are no long-lived static credentials in user browsers.

For workspaces, access is scoped by membership. Row-level security in Postgres enforces workspace boundaries on every read and write, so a query issued by one workspace can never return another workspace's rows, even if the API is compromised.

3. Access controls

Employee access to the production database is limited to a small set of engineers, gated by SSO, and logged. All admin operations run through audited server-side code paths, not against the database directly.

Third-party integrations you connect (HubSpot, Google Calendar, Gmail, Luma) authenticate through OAuth with the minimum scope set required to power the feature you enabled. Tokens are stored encrypted and can be revoked from Settings, Integrations at any time.

4. Third-party subprocessors

We use a small number of trusted third-party services to operate the platform. Each processes data under its own terms, and we treat them as subprocessors:

• Supabase for database, auth, and object storage
• Cloudflare for compute and CDN
• Resend for transactional email delivery
• Stripe for payment processing
• Anthropic and OpenAI for AI features (Maven)
• HubSpot, Google, Luma for user-authorized integrations

We do not sell or share your data with third parties for advertising.

5. Vulnerability reporting

If you believe you have found a security issue in Marvelous, please email security@bestgtm.today. We respond within one business day. We do not currently run a paid bug bounty, but we credit responsible disclosures with permission.

6. Contact

For security questions or to request our current subprocessor list, DPA, or a copy of a SOC 2 report from an underlying provider, contact security@bestgtm.today.

This page is maintained by Marvelous. It describes current, enabled controls, not certifications. It is not a substitute for a security assessment or a signed contract.