Security
Your clients trust you with their leads. We take that seriously.
Isolation between workspaces is enforced by the database itself, credentials are hashed or encrypted, and every sensitive action leaves a trace.
Tenant isolation in the database
Every CRM table is protected with Postgres row-level security. A query can only see the workspace it runs for — even if application code had a bug.
Hashed, scoped API keys
Keys are stored as SHA-256 hashes, shown only once, scoped to one workspace with read or read/write access, and revocable at any time.
Encrypted ad credentials
Google Ads, Meta and Shopify secrets are encrypted at rest with AES-256-GCM and never returned by the API.
Signed in both directions
Outgoing webhooks carry an HMAC-SHA256 signature with timestamp; incoming Shopify and Google Ads events are verified before anything is written.
Roles and visibility
Admin, sales and read-only roles per workspace, plus “only mine” visibility so reps see just their own records.
Audit log
Invitations, role changes, API keys, integrations, exports and deletions are recorded with who, when and from where.
Rate limiting
Per-key, per-session and per-IP limits, with strict quotas on sign-in, sign-up and password reset to stop brute force.
Your data stays yours
Export contacts, companies and deals to CSV at any time. A paused account is never deleted automatically.
Found a vulnerability?
Tell us privately and we will reply quickly. Please don’t access data that isn’t yours or degrade the service while testing.
Your clients’ leads deserve better than a spreadsheet.
Set up your agency, your first client and its API key in two minutes. Connect a form and watch the first lead arrive.
No card required · Cancel anytime · Or try the demo without signing up