How Mako Reach handles your data and your LinkedIn accounts
Plain facts about where Mako Reach runs, how workspaces are kept apart and what protects your LinkedIn accounts.
Hosted in the EU
The app, the database and the background workers run in the EU (Frankfurt and Amsterdam).
| Part | Location |
|---|---|
| The app (web and API) | Frankfurt |
| Postgres database | Frankfurt |
| Background workers and queue | Amsterdam |
LinkedIn sessions are handled by a third-party service whose hosting region we do not control. For that reason we do not say that all data stays in the EU.
Your data, your controls
Mako Reach is built with data export, erasure and retention controls.
- A workspace admin can export the workspace's data.
- A workspace admin can erase the whole workspace, including the LinkedIn accounts it connected.
- A single person can be erased by their LinkedIn id.
- A scheduled cleanup anonymizes data once it is past its retention period.
- A suppression list and stop keywords opt people out of messaging automatically.
Workspace isolation
Each workspace's data is kept separate at the database row level.
- Every record carries its workspace id, and the app reads and writes data through one scoped data layer that filters by it.
- Postgres row-level security is switched on for the application's data tables.
Protecting your LinkedIn accounts
Automation runs in the cloud, so there is nothing to install in your browser.
- No browser extension.
- A country proxy for each account.
- Daily caps for each account. Defaults are 28 invites and 40 messages a day, and the engine does not exceed them.
- Stop keywords and a suppression list opt people out automatically.
AI and your data
AI features run on the AI provider you connect, with your own key.
- The AI connection belongs to your workspace, and only a workspace admin can set it.
- The key is stored encrypted (AES-256-GCM) and is only shown masked afterwards.
- The AI reply agent can hand a conversation over to a person, so you keep the final say.
Secrets and integrations
Credentials are encrypted before they reach the database.
- LinkedIn session cookies, proxy passwords, Telegram bot tokens and the custom headers of your webhooks are encrypted with AES-256-GCM.
- The public REST API uses API keys that are stored as hashes, and webhooks come with a delivery log.
- Data synced to your own endpoint is signed with HMAC-SHA256. Verify the X-MakoReach-Signature header.
- Data exports do not include account session cookies or TOTP secrets.
Responsible use
All LinkedIn automation carries a risk under LinkedIn's terms. Caps, a proxy for each account and a suppression list reduce that risk. They cannot remove it.