Your CRM holds your most valuable data: your customers. This page describes the controls built into VM CRM. Security questionnaires are welcome — contact us.
Access control
- Three roles — Admin, Manager, Agent. Agents see only leads assigned to them. Managers see their team plus the unassigned pool. Admins see everything.
- Enforced on the server. Every request is filtered by the user’s role before any data is returned. Hiding a button in the interface is never the only protection.
- Invite-only accounts. Nobody can sign up on their own. Invitation links are single-use.
- No exports for agents. Bulk downloads are limited to managers and admins, and every export is recorded.
Sessions and passwords
- Passwords are stored with Argon2, a modern password-hashing algorithm, never in plain text.
- Repeated failed logins are rate-limited and locked out.
- Sessions use a short-lived access token kept in memory and a refresh token in a secure, HTTP-only cookie that page scripts cannot read.
- Changing a password signs out every other device. Deactivating a user ends all of their sessions immediately.
Audit trail
Logins (successful and failed), invitations, password changes, imports, exports and reassignments are written to an audit log that cannot be edited from the application.
Hosting and backups
- Hosted in an Indian cloud region.
- All traffic over HTTPS.
Coming soon, with our production launch:
- Encrypted database connections.
- Encrypted storage for the database and files.
- Automated daily backups with point-in-time recovery, and regular restore tests.
Engineering practices
- Every change is peer-reviewed and runs automated tests, including tests for access rules.
- Dependencies are scanned for known vulnerabilities.
- Errors are monitored so problems are fixed before they are reported.
Responsible disclosure
Found a security issue? Please email us via the contact page with the details. We will acknowledge it and keep you updated.