Legal · Last updated 21 October 2026
Security
Separated by the database
Each organisation's records are kept apart by row-level security, tested on every table.
Access you control
Roles, scopes and approvals enforced on the server for every action.
Encrypted and backed up
HTTPS everywhere, hourly backups, with encrypted copies kept off the server.
A trail you can trust
An append-only audit log, with a fingerprint that shows if entries were altered.
Separation between organisations
Every organisation’s records are separated inside the database with PostgreSQL row-level security, so a mistake in application code cannot show one organisation another’s data. We run an automated test that signs in as a member of one organisation and tries to read, change and delete another organisation’s rows on every table that holds organisation data. It must find nothing, and it passes.
Access control
- Roles and permissions are enforced on the server for every page, action and API call. Hiding a button is never the control.
- Managers see their own team’s records. Deleting or changing deal values can require an administrator’s approval.
- Organisation owners and administrators can require two-step sign-in with an authenticator app. Our own platform staff must use one.
- Sessions expire after 7 days without activity and after 30 days at most. Disabled users lose access immediately.
- Refused actions are recorded in the audit log.
Data protection
- All traffic uses HTTPS (TLS 1.2 or newer). Older protocol versions are refused.
- Passwords are stored as one-way hashes. Connected-account credentials (mailboxes, WhatsApp, Meta) are encrypted before they are stored.
- The audit log is append-only: changes and deletions are blocked in the database itself.
- Database backups are taken every night and a restore is tested.
- Uploaded files are served with downloads forced and scripts blocked.
How we check
- The public site is graded A+ by the Mozilla Observatory.
- We scan our source code with Semgrep (OWASP Top 10, TypeScript and Next.js rule sets) and our dependencies with npm audit before releases.
- Inbound webhooks from WhatsApp and Meta must carry a valid provider signature. Outbound webhook addresses to private or internal networks are refused.
Where data is stored
Production data is hosted by Hostinger in India (Mumbai). See the subprocessor list for every provider that handles data on our behalf.
Report a vulnerability
If you believe you have found a security problem, email admin@rahwe.tech with the details and steps to reproduce. Please do not access other people’s data, disrupt the service, or publish the issue before we have had a reasonable chance to fix it. We will acknowledge your report and keep you updated. Our security.txt has the same contact.