Security at CRM Zero

• Hosted on Railway — a managed cloud platform running on top of Google Cloud Platform (GCP) in US-based regions.
• Database: PostgreSQL — managed, with automated daily backups and point-in-time recovery.
• All traffic is served over HTTPS (TLS 1.2+). Plaintext HTTP is not supported.
• Deployments are automated via CI/CD — no manual SSH access to production servers in normal operations.
• Data is stored exclusively in the United States.

• In transit: All data exchanged between your browser and our servers is encrypted via TLS.
• At rest: Database volumes are encrypted at rest by the underlying cloud provider.
• Passwords: Hashed using bcrypt — we never store plaintext passwords and cannot recover them.
• OAuth tokens: Gmail OAuth tokens (used for optional Meeting Requests) are encrypted at rest using AES-256-CBC before being written to the database.
• API keys (BYO): If you supply your own enrichment provider API keys, they are encrypted using AES-256-CBC before storage and decrypted only at the moment of use.

• Multi-tenant isolation: Every database query is scoped to your organization's ID. Users can only read or write data belonging to their own organization — enforced at the application layer on every request.
• Role-based access: Within each organization, users are assigned roles (Admin, Member). Admins can manage settings, billing, and team members; Members have standard CRM access.
• Session management: Sessions are managed via NextAuth with signed, HttpOnly cookies. Sessions expire automatically.
• API keys: The REST API uses secure, per-organization API keys. Keys can be revoked at any time from the admin settings panel.
• Internal access: Production database access is restricted to authorized personnel. No standing access — credentials are rotated and access is logged.

• Your CRM data — contacts, deals, accounts, activities — is yours. We do not sell, rent, or share it with third parties for their marketing purposes.
• Enrichment: When you use enrichment features, contact data (name, email, domain) is sent to third-party data providers to retrieve publicly available professional information. This is always opt-in per enrichment request.
• Google OAuth scopes: Sign-in uses only your email address and profile. Each integration is opt-in and asks only for what it needs: connecting Gmail for meeting outreach requests the gmail.send scope (send only; we cannot read your inbox); Google Sync requests read-only access to your Google Calendar; Google Tasks requests access to your tasks; Google Drive backups use the drive.file scope, which reaches only files the app creates. We never request a scope that reads your email.
• Payments: Billing is processed entirely by Stripe. We do not store or handle credit card numbers.
• Cookies: We use only essential session cookies — no advertising or tracking cookies.

• Your data is retained for as long as your account is active.
• Account deletion: Upon request, we delete your personal data and organization data within 30 days, except where retention is required by law (e.g., billing records).
• Data export: You can export your contacts, deals, and accounts at any time via CSV export from within the platform. Full data export is also available on request.
• OAuth disconnection: Revoking a Gmail or Google connection immediately deletes the stored OAuth tokens from our systems.
• Automated database backups are retained for 7 days by the hosting provider.

• We maintain an internal incident response process for security events.
• In the event of a confirmed data breach affecting your organization, we will notify affected customers within 72 hours of discovery.
• To report a vulnerability, please email security@crmzero.ai. We take all reports seriously and will respond within 2 business days.

For security inquiries, vulnerability reports, data deletion requests, or to request our full security questionnaire response, reach out to our security team:

We respond to all security inquiries within 2 business days.