Security

Infrastructure Security

Our platform is built on enterprise-grade infrastructure designed to protect your sensitive financial services data:

• Cloud Hosting: Hosted on Supabase and Vercel with SOC 2 Type II compliance
• Data Centers: Geographically distributed with redundancy and failover
• Network Security: Enterprise firewalls, DDoS protection, and intrusion detection
• Monitoring: 24/7 automated monitoring and alerting systems

Data Encryption

All data is encrypted both in transit and at rest:

• In Transit: TLS 1.3 encryption for all data transmission
• At Rest: AES-256 encryption for stored data
• Passwords: Bcrypt hashing with salt for user credentials
• Backups: Encrypted daily backups with point-in-time recovery

Access Controls

We implement strict access controls to ensure only authorized users can access your data:

• Authentication: Secure email/password authentication with session management
• Multi-Factor Authentication (MFA): Optional email-based verification codes for additional security
• Device Recognition: We track trusted devices and alert you when new devices access your account
• Team Isolation: Row-level security ensures teams can only access their own data
• Role-Based Access: Granular permissions for admins, managers, and members
• Approval Workflow: New team members require admin approval before accessing data
• Audit Logs: Comprehensive logging of user activities and data changes

Application Security

Our application is built with security best practices:

• Secure Development: Code reviews and security testing in development lifecycle
• Input Sanitization: All search queries and user inputs are sanitized to prevent injection attacks
• CSRF Protection: Cross-site request forgery protection on all forms
• XSS Prevention: Content security policies, CSS injection protection, and HTML encoding
• Dependency Scanning: Regular scanning for vulnerabilities in third-party packages
• Rate Limiting: Database-backed rate limiting that persists across deployments
• File Upload Validation: Strict file size and type validation on all uploads
• Atomic Transactions: Critical operations use database transactions to prevent partial failures

Security Headers

We implement industry-standard security headers to protect against common web vulnerabilities:

AI & Data Privacy

For features that use AI (like contact import), we ensure your data remains private:

• No Training: Your data is never used to train AI models
• API-Only: AI features use secure API calls with enterprise privacy agreements
• Data Minimization: Only necessary data is sent for AI processing
• No Retention: AI providers do not retain your data after processing
• Anthropic Privacy: View Anthropic's privacy practices at privacy.anthropic.com

Input Sanitization & XSS Prevention

All user input fields are protected against cross-site scripting (XSS) and injection attacks:

• React Auto-Escaping: All text content is automatically escaped by React
• URL Validation: Links are sanitized to only allow http/https protocols
• Protocol Blocking: javascript:, data:, and vbscript: URLs are blocked
• HTML Escaping: Special characters in emails are escaped to prevent injection
• Length Limits: Text fields have maximum length limits to prevent abuse

Webhook & Integration Security

Third-party integrations are secured with industry-standard verification:

• HMAC Signature Verification: All webhooks (Stripe, Telegram, Easify) verify cryptographic signatures
• Constant-Time Comparison: Secret comparisons use timing-safe algorithms to prevent timing attacks
• Replay Attack Prevention: Webhooks include timestamp validation (5-minute window)
• OAuth 2.0: Google, Microsoft, Zoom integrations use OAuth with PKCE and state validation
• Token Encryption: OAuth tokens encrypted at rest with AES-256-GCM
• Cron Job Authentication: Scheduled jobs require cryptographically-verified authorization

QR Code Security

QR code generation includes input validation and escaping to prevent injection attacks:

• vCard Escaping: Contact card data properly escaped per RFC 6350
• WiFi QR Escaping: Network credentials escaped to prevent configuration injection
• Calendar Escaping: iCalendar events escaped per RFC 5545
• URL Validation: External links validated to only allow HTTP/HTTPS protocols
• Phone Validation: Phone numbers validated for E.164 format compliance

Client Portal Security

Our Client Portal allows agents to share task updates with clients securely. The portal is protected with multiple layers of security:

Compliance

We maintain compliance with industry standards and regulations:

Your Data, Your Control

You have full control over your data at all times:

• Data Export: Export all your contacts, policies, and records as CSV files anytime
• Account Deletion: You can permanently delete your account and all associated data from your settings. No hoops to jump through
• Immediate Effect: When you delete your account, all your data is permanently removed. There is no undo.

Incident Response

In the event of a security incident:

• Immediate containment and investigation procedures
• Notification to affected users within 72 hours
• Detailed incident reports and remediation plans
• Post-incident review and security improvements

Security Best Practices for Users

Help us keep your data secure by following these recommendations:

• Use a strong, unique password for your account
• Never share your login credentials with others
• Log out when using shared or public computers
• Report any suspicious activity immediately
• Keep your browser and devices updated

Request Security Documentation

Enterprise customers and security teams can request detailed documentation for their vendor assessment and due diligence reviews:

Report a Vulnerability

We appreciate responsible disclosure of security vulnerabilities. If you discover a security issue, please contact us: