Every workspace lives in its own SQLite database file on disk. Two tenants cannot read each other's data, because the rows are in physically separate files — not just logically separated by a tenant column. The same isolation extends to uploaded files (per-tenant directory tree) and to authentication (each tenant has its own user table).
Strict-Transport-Security, X-Content-Type-Options,
Referrer-Policy, Permissions-Policy,
X-Frame-Options: SAMEORIGIN (with documented exemptions
for public-embed surfaces like web forms and the booking widget).Tenant databases live on EBS volumes that are encrypted with AWS-managed KMS keys (AES-256). Daily encrypted snapshots are retained for 90 days. Uploaded attachments are stored under the same encrypted volume.
Every tenant database is snapshotted to disk on a rolling daily schedule. Snapshots are kept for 90 days by default (configurable per tenant in Settings → Backups). Restores are point-in-time to any snapshot in the window.
Every create, update and delete to your CRM data is recorded in a per-tenant audit log with the actor, action, entity, ID, before/after diff, and timestamp. The auth log records every login + logout with IP + user agent. Both are viewable from the in-app Settings → Audit log and Settings → Users → Auth log.
Every outbound webhook payload is signed with
HMAC-SHA256 over the JSON body, using a per-
subscription secret. Subscribers verify the
X-Blob-Signature header to confirm the payload was
issued by Blob and not tampered with.
We use a small set of sub-processors. The current list is in our DPA Schedule 1; we'll email workspace admins before adding a new one.
If you find a security issue, email [email protected]. We respond within one business day. Please don't publish details before we've had a chance to fix.
Questions: [email protected]