This page lists the controls that exist in the product today, and the ones that don't yet. If something is unclear, write to our security team.
What we encrypt, how we store passwords and tokens, and how data moves.
OAuth tokens for connected mailboxes and calendars, API keys you paste for integrations, and Stripe or Razorpay secrets are encrypted with AES-256-GCM and a random IV per value. After you save a key, the app never shows it again.
Passwords are hashed with bcrypt at cost 12. Password-reset links, invite codes and API keys are stored as hashes, so a database copy does not reveal them.
The app is served over HTTPS. Outbound webhooks only go to HTTPS addresses. Session cookies are httpOnly, Secure and SameSite=strict.
Every call recording is stored encrypted, and recordings past your jurisdiction's retention period are deleted automatically.
The access token lives in memory, not in browser storage. Refresh tokens rotate on use, and reuse of an old one is detected.
Confirm the hosting provider's volume encryption before stating it here. placeholder: verify before publishing
Roles decide scope and actions. Single sign-on and SCIM keep the team list in step with your identity provider.
Admin, Super User, Manager, Employee and Restricted. Each feature has View Own, View Team and View All, plus create, edit and delete. Records outside your scope return "not found". Custom roles come with the Scale plan.
An admin can Grant or Deny a single capability for one person without making a new role. Nobody can change their own role.
Choose which roles may edit each custom field. The API can also hide selected sensitive values, such as a contact's phone or a deal's value, from roles you name. A settings screen for those read rules is not out yet.
Connect an identity provider over SAML 2.0 or OpenID Connect and map its groups to roles. People managed by SSO cannot sign in with, or reset, a local password.
Create, update and deactivate users and groups from your identity provider. Group changes recompute the person's role. Deprovisioning deactivates the account and keeps their records.
Admins see recent activity under Settings → Audit Log and choose how long entries are kept before they are deleted.
On the Growth and Scale plans, you can record requests and consent and set retention per jurisdiction. Some steps still need a person.
Need help with a request? Write to us and we'll walk you through it. placeholder: privacy@ address
Guards at the edges, where data comes in and goes out.
Every query for customer data carries your workspace id, taken from your session. A workspace id in a request body is stripped. Plans and feature flags change only from our admin console.
Webhooks from calling, messaging and payment providers are checked against the provider's signature before we act on them.
Outbound webhook URLs must be HTTPS, and internal or private IP ranges are blocked.
Storage keys are generated by the server, not chosen by the uploader, and SVG uploads are blocked.
Errors return a generic message. Details stay in server-side logs.
No secret keys are shipped to the browser or kept in source control. The web app sanitises HTML before it displays it.
We want to hear about it. Send the details privately and give us a reasonable time to fix it before you share it.
security@pitch2sale.com placeholderLast reviewed October 2026.