Security

CRMcy's security posture rests on four pillars: tenant isolation, encryption at rest and in transit, least-privilege access control, and a transparent disclosure policy. Each tenant lives in its own Postgres database (not just a row-level scope), eliminating an entire class of cross-tenant data leak bugs. All API traffic is TLS 1.2+, all database connections require TLS, and sensitive fields (Vault items, OAuth tokens, e-invoice certificates) are encrypted with the per-tenant master key before they hit the database. Master keys are rotated annually with a zero-downtime re-encryption job orchestrated by the worker.

Staff access to production data flows through a break-glass process audited per-row. No CRMcy employee has standing access to tenant databases — every query is logged and a manager-approved ticket is required for support cases that need it.

Responsible disclosure

We welcome security reports. Please email [email protected] with a description of the issue and reproduction steps. Encrypt sensitive details with our PGP key (fingerprint published at https://crmcy.app/.well-known/security.txt). We commit to:

• Acknowledge receipt within 48 hours.
• Initial triage within 5 business days.
• A public CVE + advisory for any remotely exploitable issue, credited to the reporter unless they prefer anonymity.

Please do not test against production tenants you do not own. We run a staging environment at https://staging.crmcy.app for security research; request access via the same email.

Audit & compliance

CRMcy is preparing for SOC 2 Type II (audit window opens Q3 2026). Customers under regulated paths (HIPAA, KSA NPHIES) can request a copy of the security architecture overview document via [email protected].