Implemented
Tenant-aware workspaces
Workspace identity, membership roles, owner/admin boundaries, and active workspace selection keep account state scoped before sensitive actions run.
Trust center
Sales automation buyers need proof of control before speed.
Winrate is built around reviewable workflows: tenant-aware workspaces, role-aware approvals, source evidence, suppression checks, billing limits, provider readiness, and guarded AI command surfaces.
Current posture
What happens before risky work runs
IdentityOwner/admin and email verification checks
PolicyApproval, suppression, entitlement, and channel boundaries
ProviderConfigured readiness and launch blocker visibility
AuditAction proposal and execution evidence where supported
Buyer assurances
The product promise is bounded by controls that exist in the platform.
Guarded
Approval-gated sales actions
Draft campaigns, dispatch actions, guarded calls, AI worker tasks, and Telegram pause requests stay behind reviewable server-side gates.
Implemented
Usage and billing boundaries
Lead discovery, outreach dispatch quotas, voice call quotas, provider-cost budgets, included channels, and upgrade recommendations are modeled as plan controls.
Implemented
Provider readiness without browser secrets
Provider setup shows deployment-side secret names, missing requirements, guardrails, and blockers rather than asking users to paste raw credentials into the UI.
Control map
A practical view of what protects each workflow.
This is intentionally concrete. Customers should be able to tell which controls protect account state, lead quality, live outreach, integrations, and cost.
AreaControlBuyer signal
AuthenticationEmail verification and protected account lifecycle routesHigh-risk actions can require a verified owner/admin identity.
OutreachApproval, entitlement, suppression, and provider checks before dispatchOperators can review risky work before live sends or calls happen.
Lead sourcingSource-run evidence, dedupe posture, quality score, rejection reasons, and provider modeLead lists are reviewable instead of opaque AI output.
BillingPlan usage, included channels, provider-cost budgets, and upgrade recommendationsThe platform is shaped to protect customer spend and vendor margin.
IntegrationsConfigured-vs-mock provider posture and launch blockersTeams can see when a workflow is ready for live provider execution.
Command centerTelegram status checks and approval-gated proposals, not direct mutationChat control is useful without bypassing accountable in-app approval.
Responsible disclosure
A clear contact path for security reports.
Security researchers and customers should not have to guess where to send a report. Winrate publishes non-secret contact metadata while keeping stronger vulnerability-program claims out of the public beta.
FieldValueUse
Contacthello@winrate.aiUse this address for security reports and include enough reproduction detail for review.
Metadata/.well-known/security.txtMachine-readable contact, canonical URL, expiry, policy link, and preferred language.
BoundaryContact pathThis is not a rewards program, compliance certification, or mature vulnerability-response SLA.
Readiness states
Clear labels for available, guarded, and roadmap capabilities.
Available now
- Business context and Sales Blueprint capture
- Source-run evidence and dashboard discovery actions
- Campaign draft, approval, and guarded dispatch foundations
- Manual meeting scheduling and outcome tracking
- Billing, plan, usage, and provider-cost budget visibility
Guarded beta
- Voice dispatch foundations with verified owner/admin gates
- LinkedIn-style review-gated placeholder behavior
- Telegram command center for safe status, operator brief, deterministic aliases, sequence readiness, forecast visibility, and proposal creation
- AI worker registry, permissions, budget posture, and task proposals
Roadmap only
- Hands-off cross-channel sales execution
- Live scraping from every source
- Telegram commands that directly mutate outreach state
- Global compliance guarantees or unsupported browser automation
Command governance
Telegram and AI workers are being shaped as governed operators.
The long-term vision includes fast command surfaces and specialized AI workers. The current trust boundary keeps mutating effects behind approval, budget posture, audit evidence, and explicit human accountability.
Telegram
Safe status, provider, suppression, and approval-summary style commands with proposal creation for guarded work.
AI workers
Registry, permissions, allowed and blocked tools, budget posture, execution ledger, and approval proposals.
Evidence
Lead source runs expose quality score, dedupe posture, evidence snippets, and rejection reasons.
Secrets
Provider setup references deployment-side requirements and missing secret names, not raw browser-entered credentials.
Trust FAQ
Honest answers for teams evaluating sales automation risk.
How should security issues be reported?
Use the public security contact metadata at /.well-known/security.txt or email hello@winrate.ai with a concise report, affected route, reproduction steps, expected impact, and safe contact details. The current public beta does not claim a rewards program or mature vulnerability-response SLA.
Does Winrate guarantee global outbound compliance?
No. Winrate exposes guardrails, suppression checks, approval gates, and provider readiness, but legal compliance still depends on customer use case, jurisdiction, provider rules, and human review.
Can the Telegram command center approve or mutate outreach today?
No. Telegram can support guarded status-style commands, deterministic natural-language aliases, read-only operator briefs, sequence readiness, revenue forecast visibility, and approval-gated proposals. Mutating outreach or approving high-impact actions remains an in-app owner/admin responsibility.
Can configured providers go live without review?
No. Provider readiness is separate from action approval. Live-capable provider paths still pass through role, verification, suppression, entitlement, and workflow checks.
Can AI workers execute without operator governance?
No. The current AI worker surface is a governed control-plane foundation with permissions, budget posture, execution ledger, and approval proposals.