Security at OruCRM

Encryption in Transit: All data transmitted between your browser and our servers is encrypted using secure protocols.

Encryption at Rest: Sensitive data including API keys and credentials are encrypted using industry-standard encryption.

Password Security: User passwords are securely hashed and never stored in plain text.

Role-Based Permissions: Granular access controls ensure team members only access what they need.

Session Management: Automatic session expiration and invalidation when credentials change.

Email Verification: New accounts require email verification before activation.

Activity Logging: Significant actions are logged for security review and compliance.

Access Tracking: Login attempts and account activity are monitored.

Change History: Data modifications are tracked for accountability.

Secret Validation: Webhook endpoints are protected with unique secret keys.

IP Restrictions: Optional IP allowlisting to restrict webhook sources.

Request Verification: Protection against replay attacks and unauthorized access.

Data Minimization: Only necessary data is processed for AI analysis.

No Raw PII: Personal information is aggregated or anonymized before AI processing.

Read-Only Analysis: AI features cannot modify your data.

Organization Isolation: Data is strictly separated between organizations.

Secure Deletion: Deleted data is permanently removed after a recovery period.

Data Export: Full data export available before account closure.