Security — SalesOps Trust Center

Approach

SalesOps is a small, focused team operating a cloud-based B2B CRM. Our security program is proportionate to that context: we favour managed platforms with strong default controls, we minimize the personal information we collect, and we design privileged operations to require deliberate action.

SalesOps does not currently hold an independent third-party security certification such as SOC 2 or ISO 27001. Where certifications matter to your procurement process, we describe the underlying controls factually and reference the certifications of the platforms we operate on.

Authentication and access

Email and password authentication for the SalesOps application
Current Control
Google single sign-on
Current Control
Password reset with time-limited email tokens
Current Control
Session management with server-issued tokens
Current Control
Row-level authorization for workspace data
Every workspace read and write is scoped by the requesting user's workspace membership.
Current Control
Role-based access within a workspace (Admin / Manager / Rep)
Current Control
SAML / enterprise SSO
Planned
User-configurable multi-factor authentication
Planned

Application security

TypeScript-strict application code
Current Control
Server-side authorization on every mutation
Current Control
Server functions run in a sandboxed edge runtime with least-privilege secrets
Current Control
Input validation with schema validators (Zod)
Current Control
Automated dependency updates with review
Current Control
Continuous integration and code review before deploy
Current Control
Static application security testing (SAST)
In Development
Formal secure-SDLC documentation
Planned

Infrastructure

SalesOps runs on established cloud providers rather than self-managed servers. Our primary application database is hosted in the European Union (Germany). Web traffic is served through a global edge network operated by our hosting platform.

Managed Postgres database (primary region: Germany)
Current Control
Managed authentication service
Current Control
Global edge web hosting
Current Control
Isolated production and non-production environments
Current Control
Documented disaster-recovery runbook
In Development

Encryption

All SalesOps web traffic uses HTTPS in transit. Our managed database provider encrypts data at rest using its standard managed-key mechanism. SalesOps does not currently offer customer-managed encryption keys.

TLS in transit (application and API)
Current Control
At-rest encryption for the managed database (provider-managed keys)
Current Control
Customer-managed encryption keys (BYOK / HYOK)
No

Monitoring and logging

Application error logging
Current Control
Managed database audit and query logs
Current Control
Administrative-action activity trail inside the app
Current Control
Centralized SIEM with alerting
Planned
Formal on-call rotation
Planned

Vendor management

SalesOps engages a small, disclosed set of subprocessors. Each is chosen because it is a widely-used, security-mature platform. The current list is published at /legal/subprocessors and updated when new providers are engaged.

Vulnerability disclosure

Security researchers can report suspected vulnerabilities to info@salesops.ca. Please provide reproduction details and refrain from testing against production data belonging to other customers. We acknowledge good-faith reports and do not pursue legal action against researchers acting under this policy.

A machine-readable disclosure record is published at /.well-known/security.txt.

Roadmap

Enterprise SSO (SAML) and user-configurable MFA.
Formal secure-SDLC documentation and third-party penetration test.
Consolidated audit logging with anomaly detection.
Documented business-continuity and disaster-recovery testing.

Information provided in the SalesOps Trust Center is for general informational purposes and does not constitute legal advice. Contractual commitments applicable to a particular customer are governed by that customer's executed agreement with SalesOps. SalesOps is a sole proprietorship based in Sudbury, Ontario, Canada.