Security
How your workspace is kept separate, how your data is protected, and how to tell us if we have got something wrong.
Last updated: September 17, 2026
Isolation between workspaces
This is the part that matters most in a multi-tenant CRM, so it is the part we built first. Every record in ClientZapp belongs to exactly one workspace, and that filter is applied by the data layer itself on every single query — not by a condition a developer has to remember to write. The rule fails closed: code that somehow runs without a workspace context finds nothing at all rather than finding everything.
A request that carries another workspace's record identifier receives a plain “not found”. It is not a permission error, because as far as your session is concerned the record genuinely does not exist. Tests that attempt exactly this cross-workspace access are part of the suite and block any release that fails them.
Access control
- Four roles — Owner, Admin, Member and Viewer — with permissions checked on the server for every request, never only in the interface.
- Authentication uses hashed credentials and expiring API tokens. Password reset links are single-use and time-limited.
- Invitations expire after seven days and can be revoked before they are accepted.
- Rate limits sit in front of sign-in, password reset, invitations and public quotation links.
Encryption
- HTTPS everywhere, with modern TLS, on every environment.
- Database connections require TLS; the managed database is encrypted at rest.
- Uploaded files sit in private object storage. They are never publicly listable and are served only through short-lived signed links — typically 15 minutes — that expire whether or not they are used.
- Application secrets live in the hosting platform's encrypted configuration. They are not in the codebase and not in the container image.
Quotation links
A shared quotation link carries a long random token, which is the credential. We store only a hash of it, so even we cannot reconstruct a link from the database. Tokens expire with the quotation's validity date, can be revoked and reissued at any time, and are rate-limited against guessing. Search engines are asked not to index them.
Our own access
Support staff cannot browse your workspace at will. Access requires a recorded reason, is time-limited, and every action taken inside a customer workspace is written to an audit log that you can ask to see. In practice we ask you for a screenshot before we ask you for access.
Backups and recovery
- Automated daily database backups with point-in-time recovery, retained for up to 35 days.
- File storage is versioned, so an overwritten or deleted object can be recovered within its retention window.
- Restores are practised, not assumed.
How we build
- Every change goes through code review and an automated test suite before it can be deployed.
- Dependencies are kept current and monitored for published vulnerabilities.
- Deployments are immutable container images; there is no editing files on a live server.
- Application errors and failed background jobs are logged and alerted internally.
What we have not done yet
We would rather list these than let you assume them. ClientZapp does not yet have:
- a SOC 2 or ISO 27001 certification;
- an independent third-party penetration test;
- single sign-on (SAML or SCIM provisioning);
- two-factor authentication;
- customer-managed encryption keys or a choice of storage region.
Several of these are planned. If one of them decides whether you can buy, tell us — that is how the order gets set.
Reporting a vulnerability
If you believe you have found a security problem, please tell us privately before telling anyone else. Email [email protected] with Security at the front of the subject line, and include enough detail for us to reproduce it.
- We acknowledge within two business days.
- We will tell you our assessment and our intended fix timeline.
- We will not pursue legal action against good-faith research that avoids privacy violations, data destruction and service disruption — please test against your own trial workspace, never someone else's data.
- We are happy to credit you publicly once the issue is fixed, if you would like that.
We do not currently run a paid bug bounty. We do read every report ourselves.
Incidents
If a security incident affects your data, we will tell you promptly, tell you what we actually know rather than what sounds reassuring, and follow up with what we changed so it cannot happen again. Notification obligations under law are a floor, not our target.