SECURITY & DATA

Where your data lives, and what the AI can see.

Every question your security team is about to ask, answered on one page. Including the awkward one: when an AI works your CRM, exactly how much of it can it reach.

Book a security review Email security

AT A GLANCE

Data residencyIndia · EU · US

Encryptionin transit and at rest

AI accessa licensed seat, nothing more

Training on your datanever

Your rightsprivacy notice

Your data stays in the region you pick.

Chosen when your account is created. Tell us at signing which region you need.

PRIMARY REGION

India

The default. Chosen by customers who need Indian residency for regulatory or procurement reasons, and by everyone who does not ask.

records · attachments · backups

ALSO AVAILABLE

European Union

For customers with GDPR-driven residency requirements, including those selling into the EU from elsewhere.

records · attachments · backups

ALSO AVAILABLE

United States

For North American operations, and for groups standardising on a US region across the rest of their stack.

records · attachments · backups

Backups stay in the region of the records they protect, and nothing moves between regions without your written instruction.Sub-processors and transfers →

What the AI can reach, and what it cannot.

The AI Connector and AI Agent get a seat, not a back door. Everything below is enforced by the CRM, not by a prompt.

01It holds a licensed seatThe AI authenticates as a seat you created, so it can see and do exactly what that person can see and do. Your existing roles and record-level rules apply unchanged.

02Only the actions you exposedYou choose which actions the connector offers. If it is not exposed, no prompt talks the AI into it — the capability simply is not there.

03Named in the historyEvery read and write is attributed to the AI by name, beside the humans who wrote the rest. You can always see what it did, and undo it.

04Revocable in one clickDisable the seat and the connection dies with it. No separate credential to hunt down, no key left in someone’s config file.

05Never used to train a modelYour records are not used to train ours or anyone else’s models. You bring your own AI subscription, so your prompts sit under the terms you already signed with that provider.

Not ready to give an AI a seat? Run the CRM on its own and add the connector later.How the connector works →

Who can reach what.

Access is decided by the record, not by a folder someone forgot to lock.

IN EVERY PLAN

Roles and profiles. What a job title can open, edit and export, set once and applied everywhere.

Record and field rules. Down to the field, so a service agent sees the order without seeing the margin on it.

Audit history. Every change attributed, with field history and a recycle bin for what was deleted.

Session control. See active sessions, end them, and set how long a session may live.

HOW WE RUN IT

In transitTLS 1.2 or better

At restAES-256

Backupsdaily, same region

Environmentsproduction kept separate

Access to productionnamed engineers, logged

Your exportyours to take, any time

Certifications, honestly.

We would rather tell you where we are than imply a badge we have not earned.

India DPDP ActNotice, purpose limits, retention and a named Grievance Officer, published in our privacy notice.IN PLACE

GDPREU residency on request, a data processing agreement, and our sub-processor list kept current.IN PLACE

SOC 2 Type IIUnder way. Ask us where the audit stands and we will tell you plainly, including what is not covered yet.IN PROGRESS

ISO 27001On the roadmap behind SOC 2. If your procurement process requires it today, say so early and we will be straight with you about timing.PLANNED

Found something? Tell us.

We read every report from a person, and we will tell you what we did about it.

RESPONSIBLE DISCLOSURE

Email [email protected] with what you found and how to reproduce it. We acknowledge inside one working day, keep you updated while we fix it, and credit you if you would like that. We will not take legal action against research done in good faith.

IF SOMETHING GOES WRONG

If your data is affected by an incident, we tell you — what happened, what was reached, and what we changed. We would rather have an uncomfortable conversation early than a discovered one late.

Talk to a person →

Send us your security questionnaire.

We answer it ourselves, in plain language, and we say so when the answer is no. Bring your engineers to the call.

Book a review Privacy notice