Security at
Pointof-CRM

We are a small team, and we would rather tell you precisely what we do than imply more than we can back up. Everything on this page describes how Pointof-CRM works today. Where we have not done something yet, we say so in What we have not certified rather than leaving it out.

Two principles decide most of our choices. First, an organization’s data should be unreachable from any other organization, and that should be enforced in more than one place. Second, you should be able to leave with everything you put in, whenever you want — because software you cannot leave is software you cannot really evaluate.

Pointof-CRM runs on PostgreSQL hosted by Supabase, on managed cloud infrastructure. We do not run servers under a desk or keep copies of your database on laptops.

• In transit — every connection to the application and the database is encrypted with TLS. The application refuses plain HTTP.
• At rest — database storage and backups are encrypted by our infrastructure provider using AES-256. This is a property of the platform we build on, not something we implement ourselves, and we would rather say that plainly than claim credit for it.
• Secrets you give us — where you store a credential inside Pointof-CRM, such as your own AI provider key, we encrypt it in our own application layer with AES-256 before it reaches the database, and decrypt it only in memory at the moment it is used.

Pointof-CRM is multi-tenant: many companies share the same database. Keeping one company’s records out of another’s is the single most important thing the system does, so it is enforced in layers rather than once.

• Every record carries an organization. Each row is stamped with the organization that owns it, and every query the application makes is scoped to the organization of the signed-in user. A request cannot ask for records without saying which organization it is asking as.
• Row-level security in the database. Tables across the schema carry PostgreSQL row-level security policies, so the database itself filters rows by organization rather than trusting the application to remember.
• The privileged key never leaves the server. The service role key that can bypass those policies exists only in server-side code and is never sent to the browser.

Inside an organization, access is controlled by roles and by 56 individual permissions — not by a single admin switch.

• 5 built-in roles, plus a role builder so you can define your own and grant exactly the 56 permissions you intend — no more.
• Permissions gate actions, not just menus. Hiding a button is not access control. Sensitive operations check the permission on the server before they run: exporting your data, for instance, requires an explicit export permission, so a user who should not be able to take the customer list off the platform cannot.
• Removing someone is immediate. Access is resolved per request from their current role and permissions, so a change applies on their next action rather than whenever a cached session happens to expire.

• We never see your password. Authentication is handled by Supabase Auth, which stores a salted hash. There is no place in our code where a password exists in readable form, which also means we cannot tell you what yours is — only help you reset it.
• Two-factor authentication. Time-based one-time codes (TOTP) from any standard authenticator app. Once enabled, sensitive areas require a session that has actually passed the second factor, not merely an account that has it switched on.
• Recovery codes. Single-use codes issued when you turn on two-factor authentication, so losing a phone does not lock you out of your own business.

Security-relevant events are recorded with who did them and when — sign-ins, two-factor changes, recovery code use, and administrative changes to users. Administrators can review this history from inside the application.

This matters most in the ordinary case rather than the dramatic one: knowing which colleague changed a permission last Tuesday is usually the question you actually need answered.

Pointof-CRM includes AI features across the product. Because they send your records to a language model, it is worth being exact about what happens.

• You can bring your own key. Connect your own account with OpenAI, Anthropic or Google, and the requests go to your provider under your terms. The key is encrypted with AES-256 before storage, as described above.
• If you do not, we provide one. Organizations without their own key use a platform key so the features still work. Plan limits apply in that case — see pricing.
• Only the relevant records are sent for the task you asked for, and your data is not used to train models.
• The MCP endpoint is authenticated. Connecting an external assistant requires a bearer token, and that assistant is bound by the same organization scoping and permissions as the person it acts for.

You can export your records from inside the application at any time, on any plan. There is no retention hold, no sales conversation required to get your list back, and no format we keep to ourselves.

We act as a processor for the records you put into Pointof-CRM — your contacts, organizations, deals and documents remain yours throughout. What we do with account data, and how deletion works, is set out in our Privacy Policy.

Most security pages are written to leave an impression. This part is here so you can make a decision with the actual facts.

• We do not hold SOC 2, ISO 27001 or any comparable audit. These are expensive, take months, and we have not done them. If your procurement process requires one, we are not the right fit yet, and we would rather tell you now than during your review.
• We are not HIPAA-ready and do not sign BAAs. Pointof-CRM is not built for protected health information.
• We have not had a third-party penetration test. If you intend to run your own against your organization’s account, write to us first and we will agree a window rather than treat it as an attack.

We will update this section as these change, rather than quietly removing it.

If you believe you have found a vulnerability, email admin@pointofcrm.com with enough detail to reproduce it. We will acknowledge you, and we will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it before going public.

Please do not test against other organizations’ data, and do not run automated scanning that would degrade the service for the businesses using it.