Security

Companies keep their customers’ data in the CRM, so its security is a priority for Intrawebix SRL (company ID 1025600049858). Below: how we protect data, and how to report a vulnerability to us.

1. Where the data is

• The Service runs on servers in Germany (European Union), at Leaseweb.
• Backups and a replica of the database, for disaster recovery, are kept on our server in the Republic of Moldova.
• The full list of providers that process data is in the Data Processing Agreement.

2. Separation of data between companies

Each company sees only its own data. Separation is enforced in the database itself (Row-Level Security), not only by the application: even a bug in the code would be stopped there. The application connects to the database with a role that has no administrative rights.

3. Encryption

• All connections are encrypted (HTTPS, with HSTS).
• Passwords are stored only as irreversible hashes (Argon2).
• Integration credentials (mailbox passwords, bot tokens, phone system keys) are encrypted in the database.
• Card details never pass through our servers: payments are made directly with Paddle or PayPal.

4. Accounts and access

• Two-step verification (TOTP app and backup codes).
• Limits on sign-in attempts and bot checks (Cloudflare Turnstile) at sign-up and password reset.
• Changing the password or two-step verification closes other sessions.
• Company roles (owner, administrator, member); API keys can be read-only and have no access to the account, billing or members.
• Our team enters a company’s account only with its consent, for a limited time, read-only, and every such access is logged.

5. Infrastructure

• Servers can be administered only through a private network, with keys; password and root sign-in are disabled.
• Firewall: no port is open to the internet; web traffic goes through Cloudflare.
• Operating system security updates are installed automatically.
• The application’s pages use strict security policies (Content Security Policy, protection against being framed by other sites).
• Connections to servers chosen by companies (email, phone systems, webhooks) cannot reach our internal network.

6. Backups and recovery

• The database and files are backed up daily, and the copies are transferred outside the data centre.
• In addition, a replica of the database is updated continuously on another server.
• Backups are kept for 14 days on the main server and 30 days on the backup server.

7. Your data, under your control

• A change history for every record (who, what and when).
• A full export of the company’s data at any time (CSV and files).
• When an account is closed, data is deleted from the application within 30 days, and from backups within at most another 30 days.
• Webhooks sent to your servers are signed, so you can verify they are authentic.

8. Vulnerability disclosure

If you have found a vulnerability, please report it responsibly under the rules below: we will fix it as quickly as possible, and we thank you.

How to report

Write to [email protected] with the subject “Security” and include:

• a description of the issue and where it occurs (address, feature);
• the steps to reproduce it and, if possible, evidence (screenshots, requests);
• the estimated impact (what an attacker could achieve).

We acknowledge your report within 5 business days, keep you informed while we assess and fix it, and tell you when it is resolved. Critical issues are handled with priority, usually within a few days.

Rules for research

• test only with your own accounts (you can create a test company: the trial is free);
• do not access, modify or delete the data of other companies or people; if you reach data that is not yours, stop, do not keep it and tell us immediately;
• do not disrupt the Service or degrade other users’ experience;
• keep the issue confidential until we fix it (at most 90 days from your report, unless we agree otherwise).

Out of scope

• denial-of-service attacks (DoS / DDoS) and sending unsolicited messages (spam);
• social engineering or phishing against our team or customers;
• attacks on data centres or physical equipment;
• third-party services we use (for example Cloudflare, Leaseweb, Paddle): report to them directly, under their own policies;
• automatically generated reports without a demonstrated issue, and gaps with no practical security impact.

Legal protection

If you follow the rules above and act in good faith, we consider your research authorized: we will not take legal action or file complaints against you for it. This assurance does not cover third-party services and does not exempt you from the laws that apply in your country.

Rewards

We do not have a bounty program at the moment. With your consent, we will thank you publicly after the fix.

Security contact details are also published in the standard format at /.well-known/security.txt.