How does Revenue Proven secure my data and OAuth tokens?
All OAuth tokens are encrypted with AES-256-GCM before being stored, and Revenue Proven never stores your CRM or LinkedIn credentials in plaintext at any point.
Revenue Proven was designed from the start to treat your LinkedIn Ads and CRM tokens as sensitive credentials. Every OAuth token is encrypted using AES-256-GCM, a symmetric authenticated encryption standard, before it is written to the database. The encryption key is stored separately from the database, so compromising the database alone does not expose the tokens.
How token encryption works
When you connect LinkedIn Ads or your CRM, Revenue Proven completes the OAuth flow and receives an access token and refresh token from the provider. Before writing either to the database, the application encrypts them using AES-256-GCM with a unique initialization vector per token. The encrypted ciphertext is what gets stored. When the sync pipeline needs to make API calls, the application decrypts the token in memory for that request only.
- AES-256-GCM encryption on every OAuth token before storage
- Unique initialization vector per token, preventing pattern analysis
- Encryption key is separate from the database
- Tokens are decrypted only in memory, never logged
- Token scopes are introspected and stored to detect permission changes
Password security
User passwords are hashed with bcrypt before storage. Revenue Proven does not store plaintext passwords and cannot retrieve your password if you forget it, which is why the password-reset flow generates a time-limited token sent to your verified email.
Session security
Sessions are managed by NextAuth and stored as signed JWTs. The JWT secret is configured at deploy time and rotates when you change it in the environment configuration. All web traffic is served over HTTPS with Cloudflare at the edge.