Security

Security that isn't an upsell

Every workspace gets the same hardened foundation - isolation, access control, hardened sessions, and full auditability.

Your workspace is isolated

Your data lives in your workspace and nowhere else.

Every record is bound to your workspace at the data layer
Isolation is enforced on the server on every request
Isolation is covered by automated tests on every release
Export your data whenever you want - no lock-in

Access is controlled

The right people see the right things - down to the field.

Role-based access control with granular permissions
System roles plus custom roles for your org structure
Field-level permissions hide sensitive data by role
The customer portal runs on its own separate, capability-based access model

Sessions are hardened

Modern web security, configured strictly.

httpOnly cookie sessions - tokens are never exposed to browser JavaScript
A strict Content-Security-Policy ships on every response
HSTS and hardened headers in production
Portal sessions are fully separate from staff sessions

Secrets stay secret

Sensitive values are handled like they matter.

Passwords stored with strong one-way hashing
Payment-provider credentials are never displayed after setup
API tokens are shown once and stored hashed, with per-use audit
Public payment pages expose only safe, minimal fields

Everything is accountable

You can always answer "who did what, when".

A workspace-wide event trail records changes across modules
AI actions are confirmation-gated and logged with cost
Billing is itemized to the individual action and actor
Field value history shows what changed and by whom

Frequently asked questions

Where do my session tokens live?

In httpOnly cookies that browser JavaScript can never read. The application proxies API calls server-side, so tokens never appear in your browser's storage.

Can I take my data out?

Yes - reports, contacts, and custom-field data export to CSV and Excel at any time, and the API gives you programmatic access with scoped tokens.

How is the customer portal kept separate?

The portal uses its own session and a fixed, capability-based access model. Portal users can only ever reach portal data - never staff screens or other customers' records.

Where to go next

The modules teams usually reach for alongside this one, and the industries that lean on it hardest.

Teamwork, Roles & Data Access No-Code Customization API, Webhooks & Integrations

This capability, in your industry

Law Office CRM Medical Clinic CRM Insurance Agency CRM

Ready to grow with every customer?

Build your workspace and start the same day. Setup takes less than ten minutes.

Get started Talk to sales

One subscription · Every module included · No feature gates