What Cadento Connects To

Cadento is a marketing calendar for DTC brands. It connects to your existing tools via read-only OAuth — we don't connect to raw email inboxes (like Gmail or Outlook). The integrations we support:

Klaviyo— read-only campaign, template, and account data. We can't send emails or modify anything.
Figma — read-only file thumbnails for linked design files.
Shopify — read-only product and order data (optional).

We never receive or store passwords for any of these services. OAuth handles authentication, and access can be revoked at any time from the third-party service or from your Cadento settings.

How We Protect Your Data

Encryption

In transit:HTTPS (TLS 1.2+) everywhere. Terminated at Vercel's edge.
At rest: Postgres database (Neon) encrypts all data at rest.
OAuth tokens: Klaviyo and Figma access tokens are encrypted with AES-256-GCM before they touch the database.
Passwords:Bcrypt hashed. We never store plaintext passwords, and we can't recover them if lost.

Authentication

Email + password with bcrypt hashing
PKCE (Proof Key for Code Exchange) on all OAuth flows
Session cookies signed and httpOnly

Tenancy Isolation

Every database query is scoped by user ID at the query layer. Users cannot see each other's campaigns, tokens, or account information. Our API endpoints authenticate every request and reject any attempt to read another user's data.

Minimal Scopes

We request the smallest OAuth scopes needed to make Cadento work:

Klaviyo: accounts:read campaigns:read templates:read
Figma: file_content:read
Shopify: read-only product and order scopes

We can't send emails, modify campaigns, or write to any connected account.

Where Your Data Lives

Data	Location	Protection
Account & campaign data	Neon (Postgres) US East (AWS)	Encrypted at rest + in transit
OAuth tokens	Neon (Postgres) US East (AWS)	AES-256-GCM + at rest encryption
Email screenshots	ScreenshotOne CDN Cached 30 days	HTTPS in transit
Backups	Neon automated backups Retained 7 days	Encrypted at rest

All infrastructure is US-based. We do not currently offer EU data residency.

Third Parties That Touch Your Data

We use vendors for hosting, storage, and rendering. Each has their own security posture and privacy policy:

Vercel — application hosting (SOC 2 Type II, ISO 27001)
Neon — Postgres database (SOC 2 Type II)
ScreenshotOne — renders email HTML into thumbnail images
Anthropic (Claude) — powers AI features when you use them. Zero-retention API tier: no training on your data, 30-day retention max.

Full vendor list and a signable DPA are available on the DPA page.

Your Controls

Revoke access anytime. Disconnect Klaviyo, Figma, or Shopify from Cadento Settings, or revoke from the third-party service directly. Our OAuth tokens are deleted immediately on disconnect.
Delete your account. Full deletion from Settings. All associated data is permanently removed within 30 days.
Export your data. Email hello@cadento.co and we'll send you a copy within 7 days.
Sign a DPA. Standard GDPR-compatible DPA available on request.

Honest Limits

We're a small, focused company. Here's where we are honestly, so you can make an informed decision:

No SOC 2 or ISO 27001 (yet).If your organization requires certified vendors, we're not the right fit today. We rely on certified sub-processors (Vercel, Neon, Anthropic) for the underlying infrastructure.
No third-party penetration test yet.We do internal security reviews and follow standard practices, but we haven't contracted an external audit.
Operator access exists.As with any small SaaS, our operators have technical access to production systems to diagnose issues. We don't browse customer data casually, and access is logged, but the capability exists.
AI processing.When you use AI features, relevant campaign context is sent to Anthropic's API. It's covered by their zero-retention API policy, but the data does leave our systems to reach them.

We'd rather be upfront about all of this than let you find out later.

Incident Response

If we discover a security incident that affects your data, we'll notify you by email within 72 hours of confirming impact, with what we know, what we're doing, and what — if anything — you should do.

Report a Vulnerability

Found something? Please email hello@cadento.co with details. We'll acknowledge within one business day and work to resolve promptly. We don't currently run a paid bounty program, but we'll credit responsible disclosures on request.

Questions

If you're a partner or brand reviewing us and you have specific security questions, email hello@cadento.co and we'll answer them directly. We'd rather have the conversation than have you guess.

Security