How we protect your workspace

Every business works in its own workspace, and every record (leads, contacts, notes, tasks, tags, and pipelines) belongs to exactly one workspace.

Isolation is enforced by the database itself using Postgres Row Level Security. Before the database returns or changes a row, it checks that the signed-in person is a member of that row's workspace. If they aren't, the row simply doesn't exist as far as their request is concerned. A workspace you don't belong to looks exactly like one that doesn't exist.

We test these rules with automated tests that run against the real database schema, including attempts to read and write another workspace's records.

• Your browser never talks to the database, the AI provider, or the payment provider directly. Every read and write goes through our server.
• Every change is checked on the server: your session is verified, your membership in the workspace is looked up in the database, and your role (owner, admin, or member) must allow the action.
• Roles and workspace IDs sent by a browser are never trusted. They are always determined on the server from your verified session.
• Hiding a button in the interface is a convenience, not a security control. The server and the database both enforce permissions again.

In production, connections between your browser and Apparus CRM use HTTPS (TLS), and our server connects to its providers over encrypted connections as well.

• Normal requests use a restricted database key together with your own session, so the database's isolation rules always apply.
• A privileged service key exists for a small number of narrowly scoped server tasks, such as storing contact form messages, processing billing events, and deleting an account at its owner's request. It is never used for everyday reads and writes.
• Secret keys live only on the server and are never sent to the browser.

• AI features only run when a person asks for them, and owners can turn AI off for their workspace.
• Only a minimized copy of the relevant record is sent to the AI provider. Contact email addresses and phone numbers are left out, and we make a best-effort attempt to remove them from free text.
• Record content is clearly separated from our instructions to the model and treated as data, which helps reduce the risk of text in a note steering the AI.
• We don't store prompts or AI responses. We keep a small record of each request (feature, time, model, token counts, and outcome) to enforce limits.
• Outputs are drafts. Apparus never sends messages on your behalf.
• Per-workspace monthly limits and per-minute rate limits prevent runaway usage.

• Passwords are handled by our authentication provider (Supabase Auth). We never see or store them in readable form.
• Rate limits on sensitive actions such as invitations, AI requests, and the contact form.
• A strict Content Security Policy that limits which scripts can run on our pages.
• Structured logs designed to exclude record contents, passwords, and tokens, with sensitive fields redacted automatically.
• Destructive actions require confirmation, and deleting records is limited to owners and admins; members can archive instead.

• Use a long, unique password for your Apparus account.
• Give teammates the least access they need, and remove people who no longer need access.
• Don't store payment card numbers, government ID numbers, passwords, or health information in your workspace.

Apparus CRM has not yet completed any third-party security audits or certifications. We will update this page if that changes.

If you believe you have found a security vulnerability, please email security@example.com [placeholder address — replace before launch] with a description and steps to reproduce.

Use the contact form (topic: Security) until a dedicated address is published. Describe the issue briefly and we'll reply with a way to share the details.

• Only test against accounts and workspaces you own.
• Do not access, change, or delete other people's data, and stop if you encounter any.
• Do not degrade the service (no denial-of-service testing, spam, or social engineering).
• Give us reasonable time to fix the issue before sharing details publicly.

We appreciate good-faith reports. We do not currently offer a bug bounty.