Workspace isolation
Every record belongs to a workspace, and the boundary is checked in the API on each request — not enforced by hiding things in the interface.
Trust
Built for data that belongs to somebody else.
A CRM holds your customers' contact details, prices and conversations. These are the controls that exist in the product today — and, below them, the ones that do not.
Role-based access control
Permissions decide what each person can read and change, and the same rules apply to the REST API and to Ira AI.
Field-level permissions
Individual fields can be restricted per role, so sensitive values stay hidden from teammates who should not see them.
Encrypted credentials
Integration secrets, OAuth tokens and webhook signing keys are encrypted with AES-256-GCM before they are stored, and are never returned to the browser.
Hashed passwords
Account passwords are stored as bcrypt hashes. They are never written to logs and cannot be read back out of the system.
Signed webhooks
Outbound webhooks are signed so you can verify they came from us. Inbound webhooks are signature-checked, and the workspace is resolved from our own records rather than from the payload.
Malware scanning on upload
Files are scanned before they are stored. If the scanner is unavailable the upload is refused rather than accepted unscanned.
Hardened file handling
Storage keys are validated against the owning workspace, and downloads are served with headers that stop a file being executed in the browser.
Audit trail
Sensitive actions are recorded, so a change can be traced back to the account that made it.
Encrypted in transit
All traffic to the application and the API is served over TLS.
What we do not offer today
- Single sign-on (SSO). SAML, OIDC and SCIM provisioning are not implemented. Access is managed with accounts, roles and field-level permissions inside the workspace.
- SOC 2 or ISO 27001 certification. We hold neither. We would rather say so than display a badge we have not earned.
- A published uptime figure or SLA. We do not measure and publish availability, so we do not quote a number for it.
No system is unbreakable, and we make no claim to be. If one of these is a requirement for you, raise it on a demo call and we will tell you exactly where we stand.