Home/Security

CRM data security, explained without badges

You are about to put your entire customer list into someone else’s software. That deserves a straight explanation of how your lead data is stored, who can reach it, and what happens if something goes wrong — not a wall of logos.

How it works

Four things that actually matter

Complete separation between companies

Every workspace is isolated. Each company’s leads, users, settings and reports are scoped to that company on every single read and write — enforced in the data layer itself, not left to individual screens to remember. There is no feature, anywhere in the product, that lets one company see another’s data.

Two-factor authentication

Turn on TOTP-based 2FA using Google Authenticator or any similar app, with recovery codes in case you lose your phone. Accounts also lock automatically after repeated failed login attempts, and every login attempt is recorded.

API keys you can actually control

API keys are scoped to specific modules, rate limited per minute, and can be restricted to an IP whitelist. Only a hash of each key is ever stored — the raw key is shown once, at creation, and never again. Revoke any key instantly.

Locked-down landing page scripts

Each landing page script only accepts submissions from the domain you registered — and optionally from one exact page URL. Every landing page also has its own per-minute rate limit, so a bot cannot flood your pipeline with junk.

What we do with lead data

Lead and customer data you collect belongs to you. We access it only to operate, support and secure the service. We do not sell it, we do not use one company’s data to benefit another, and we do not train anything on it.

The one time data leaves the platform is when you explicitly connect Google Ads or Meta and map a pipeline stage to a conversion action. At that point, and only for workspaces that have set this up, the conversion event you configured is sent to that platform — the original click ID, the conversion name and optionally a value.

You can export your data at any time, and cancelling is a button in your billing screen, not an email negotiation.

Being honest about our size

We are a young product, not a multinational with a compliance department. We are not going to put logos of certifications we do not hold on this page, because you would find out eventually and rightly stop trusting everything else we said.

What we will do is answer specific security questions directly. If your business has requirements we need to meet, ask us and you will get a real answer — including “not yet” where that is the truth.

The specifics

For procurement teams and platform reviewers who need the control list rather than the explanation.

Encryption

TLS on every connection to the application and the API.
Databases and backups encrypted at rest.
Advertising platform access tokens encrypted at the application layer, separately from disk encryption, so a database copy alone does not yield usable credentials.
Passwords stored only as bcrypt hashes. They cannot be recovered, by us or by anyone.

Hashing before transmission

Email addresses and phone numbers are SHA-256 hashed on our server before any conversion is sent to Google Ads or the Meta Conversions API.
Raw contact details are never transmitted to either platform. The only unhashed values sent are the platforms' own identifiers — gclid, fbc, fbp, and the lead_id Meta itself issued for an Instant Form submission, which Meta requires unhashed to match its own record.

Access control

Role-based permissions within each workspace, checked on every action rather than only hidden in the interface.
TOTP two-factor authentication available on user accounts, and required for administrative access to production infrastructure.
Each company's data is logically isolated and scoped on every database read and write.
API keys are scoped, rate-limited and individually revocable.

Backups

Encrypted, automated, on an approximately 90-day rotation.
Restored only wholesale in a disaster. Backups are never queried to look up an individual record, which is why deleted data may persist in them until it expires — stated plainly on our deletion page rather than glossed over.

Breach notification

We notify affected customers within 72 hours of becoming aware of a personal data breach, and we send that notice even if the full picture is still emerging rather than waiting until it is complete.
The notice states what happened, which categories and roughly how many records are affected, the likely consequences, what we have done, and who to contact.

Reporting a vulnerability

Email contact@claudphic.com with “Security” in the subject. We acknowledge within 2 working days and will keep you updated until it is resolved. We will not pursue legal action against anyone who reports a genuine issue in good faith, gives us reasonable time to fix it, and does not access or modify data belonging to others while investigating.

What we do not have

No SOC 2 report and no ISO 27001 certification. We are not going to imply otherwise, and we would rather lose a deal over it than be found out later. If your procurement process requires one, tell us — we will say honestly whether and when we expect to have it rather than stalling.

Ask a security question Read the privacy policy

Ready when you are

Start free, keep full control of your data, and leave whenever you like.

Start free Contact us