Your relationships are sacred. So is your data.

Encrypted in transit

All connections use TLS encryption. We enforce HTTPS-only connections so your browser never falls back to an unencrypted channel.

Encrypted at rest

Your data is stored on Neon PostgreSQL, which encrypts all data at rest. Neon maintains SOC 2 Type II compliance. Credentials for the accounts you connect (Gmail, Slack, Granola, Mailchimp) and two-factor secrets are encrypted a second time by the application, with a key held outside the database.

Hosted on Vercel

Our application runs on Vercel's edge network with built-in DDoS protection. Vercel maintains SOC 2 Type II compliance. See security.vercel.com for details.

Protected at the edge

Vercel's firewall rate-limits sign-in and our public endpoints before a request reaches the application, and logs automated traffic for review.

Security headers

We set strict Content Security Policy, X-Frame-Options, and other headers to protect against clickjacking, XSS, and content injection.

Organization-level separation

Every database query is filtered by your organization. Your data is never accessible to other accounts. Automated checks run on every code change to verify that each server action authenticates its caller and each owner-only action checks the caller's role, and we audit the full surface by hand each quarter.

Role-based access

Organization owners control who has access and who can export data, delete the workspace, or manage integrations. Team members can only see data within their own organization.

Private touches

Owners choose, per source, whether synced email, texts, and meeting transcripts are visible to the whole team or only to the person who captured them. Private contents stay out of teammates' views, shared AI memory, and other people's exports. That a touch happened stays visible, so cadences and dashboards keep working.

Where you're signed in

Sessions expire after 30 days of inactivity and are invalidated on logout. You can see every active session, with its device and approximate location, on your profile and sign out of all of them at once. Sign-ins from a new country are flagged in your workspace's security log.

Rate limiting

Sign-in, API, and public endpoints are rate-limited at the edge and again in the application to prevent brute-force and scraping attacks.

Your data never trains AI models

We use Anthropic's Claude for AI features. Anthropic does not use API inputs to train their models. Your notes and context are processed, not learned from.

You control what AI sees

AI suggestions are generated from the notes and context you've entered. You decide what to capture, and AI only works with what you've provided.

AI suggests, never acts

AI proposes touch suggestions with reasoning you can review. It never sends messages, creates records, or takes action on your behalf.

Transparent reasoning

Every AI suggestion includes an explanation of why it was made, so you can evaluate the recommendation before acting on it.

You approve connected assistants

When you connect Claude to your CRM, it can read your relationships and pipeline to answer questions. Only if you separately grant write access can it create people, touches, tasks, and opportunities — it can never send, delete, or edit anything, every write is listed in Settings, and each one can be undone. Connecting requires you to sign in and explicitly grant access, and you choose which workspace.

Connections are yours, and revocable

Each connection is tied to your own account, is never shared between people, and can be disconnected instantly from Settings.

Password security

Passwords are securely hashed before storage using industry-standard algorithms. We never store or log plaintext passwords.

Two-factor authentication

Add an authenticator app to your account, with recovery codes as a backup. Workspace owners can require a second factor for every member of the team.

Passkeys

Sign in with Touch ID, Face ID, Windows Hello, or a hardware security key instead of a password. Passkeys are phishing-resistant: they only work on our domain, so a look-alike site cannot use them.

Bot protection

Login and signup are protected by Cloudflare Turnstile to prevent automated attacks.

No third-party tracking cookies

We use a single, essential session cookie for authentication. No advertising or third-party tracking cookies.

API key security

API keys are scoped to what each integration needs, securely hashed before storage, and can be revoked at any time from Settings.

Continuous monitoring

Failed sign-ins, rate-limit trips, and blocked outbound requests raise an alert within minutes. A weekly security digest is reviewed by a person, not just filed.

Audit trail

Owners can see a log of security and admin events in Settings: sign-ins from new locations, two-factor and API key changes, team changes, and every write a connected assistant makes. Security events are kept for 90 days and admin events for a year.

Incident response

We keep a written incident response procedure covering containment, credential rotation, and notification. If an incident affects your data, we tell you what happened and what we did.

Availability

The application is monitored externally around the clock, and errors are reported to us with personal data stripped.

Stripe handles payments

All subscription payments go through Stripe, which is PCI DSS Level 1 certified. We never see or store your full card number.

Gift purchases

When you buy a gift through Goody, card details are entered in a Very Good Security (VGS) hosted form and tokenized before they reach Goody. They never pass through our systems.

Mac text sync

Our Mac app syncs the text of your iMessage conversations — but only with people already in your CRM, matched on your device, so nothing else ever leaves your Mac. Calls sync as who-and-when only. Synced texts are stored like your emails (encrypted at rest), follow your workspace's private-by-default setting, and can be kept private to you.

What the extension accesses

The Chrome extension reads publicly visible information from LinkedIn profile pages you visit — name, headline, company, location, photo, and about section. It only reads data when you click "Add to Authentic."

Data stays in your CRM

Profile information is sent directly to your Authentic CRM account over an encrypted connection. It is not shared with any other service or third party.

No background data collection

The extension does not monitor your browsing activity, collect data from other websites, or run in the background. It only activates on LinkedIn profile pages.

Local storage

The extension stores only your API key locally in Chrome's sync storage to authenticate with your CRM account. You can revoke the key at any time from Settings.

Your data is yours

You own the data you put into Authentic CRM. We do not sell your data to third parties, and we never will.

Data export

Organization owners can export all data at any time from Settings. The export is a JSON file containing your people, companies, touches, tasks, milestones, opportunities, knowledge items, and more.

Account deletion

Organization owners can delete their organization and all associated data at any time from Settings. Deletion is immediate and permanent.

GDPR

We respect your data protection rights including access, correction, deletion, and objection. Contact us to exercise any of these rights.