Security
How we protect your business data
Your CRM holds your customers, your pricing and your deals. Here is exactly what we do to keep it safe, in plain language. Only what is true today.
Last updated: October 18, 2026
What's in place
Your data stays in your workspace
Isolation is enforced twice: our code scopes every query to your workspace, and the database itself blocks access to other workspaces' records (PostgreSQL row-level security). Automated checks run on every code change.
Encrypted in transit
The app is served over HTTPS only, with HSTS so browsers refuse plain-HTTP connections. Security headers block clickjacking and content sniffing.
Secrets encrypted at rest
Connection tokens and API keys for your integrations (Google, Microsoft, Zoom, Twilio, Dropbox, QuickBooks, Slack) are encrypted with AES-256-GCM before they are stored.
Strong sign-in
Sign in with Google or Microsoft, or with a password. Passwords are hashed with bcrypt and never stored in plain text. Two-factor authentication works with an authenticator app or an email code, with backup codes for recovery.
Admins can require 2FA
Workspace admins can require two-factor authentication for everyone. Repeated failed sign-in and 2FA attempts are rate-limited.
Roles and permissions
Role-based access control decides who can see and change what, down to individual record types. Give each person only the access they need.
Audit log
Changes are recorded with who made them, when, and the before and after values. Admins can review the audit log at any time.
Verified webhooks
Inbound events from Twilio, Slack, Zoom, Square and DocuSign are checked against the sender's signature before we act on them.
Automated backups
Our database is backed up automatically, so your records can be restored if something goes wrong.
Your data is yours
Export your records to CSV or Excel at any time. If you leave, ask us to delete your workspace and we remove your data within 30 days.
Where we stand on compliance
We have not completed a SOC 2 or ISO 27001 audit yet, and we won't show a badge we haven't earned. We are building our security program with SOC 2 in mind, and we will post the report here when it is done.
Need a security questionnaire filled out for your team? Email security@coeffection.com and we'll answer it.
Vendors that handle your data
These providers help us run the service. When you connect an integration such as Gmail, Outlook, Zoom or QuickBooks, data flows between Coeffection and that service only as needed for the features you turn on.
| Vendor | What it does for us |
|---|---|
| DigitalOcean | Application hosting, database and file storage |
| Cloudflare | Storage for signed-document audit trails |
| Resend | Transactional email delivery |
| Square | Subscription billing and payments |
| Anthropic, OpenAI, Google | AI features, when you use them |
| Twilio | Calling and SMS, when you turn them on |
Report a security issue
Found a vulnerability? Email security@coeffection.com. We follow responsible disclosure with a 90-day window. Please don't access other customers' data or disrupt the service.
See also our Privacy Policy and Terms of Service.