Security
This page sets out what is in place today. It only describes things we have checked in the product itself — if something isn’t listed here, don’t assume it.
Sign-in
- Delta CRM, including its knowledge base, uses Sign in with Google, handled by Auth0.
- Delta Learn uses the same sign-in as Delta CRM.
- Other sign-in methods, such as SAML single sign-on or Microsoft accounts, aren’t available.
Permissions
- In Delta CRM, what each person can see and do is set by a role permission matrix, with overrides for individual users.
- The CRM’s server checks permissions on its API routes, and an automated test fails the build if a route has no permission guard.
Records of activity
- Delta CRM keeps an activity log of changes, and data exports need permission and are recorded.
Connected accounts
- Access tokens for connected services — Gmail, HubSpot, Google Analytics, Google Ads and Aircall — are stored encrypted in the CRM database.
- Gmail access is limited to reading and sending mail.
Hosting
- Delta CRM, including its knowledge base, is hosted on Google Cloud in Sydney, Australia.
- Delta Learn runs alongside Delta CRM, in the same application and database.
- Google Cloud encrypts the data it stores by default.
- You can’t currently choose where your data is hosted.
AI features
- The knowledge-base assistant only sends the model the articles it retrieved for that question, and ticket notes are redacted of personal details before they are used to draft articles.
Third parties
The services that process data on our behalf are listed in the Privacy Policy.
See the list of subprocessorsReporting a security issue
If you think you’ve found a vulnerability, email crm@deltastrike.com. Please include enough detail for us to reproduce it, and give us a reasonable chance to fix it before sharing it publicly.