NameCRM security
NameCRM holds what a service business cannot afford to leak: client records, emails, call recordings, contracts and invoices. This page explains how that information is protected, in plain words first, with the technical detail underneath for whoever checks it for you.
Every statement here describes how NameCRM works today. Where some information leaves Canada, we say so.
- Where your database and files are stored
- Canada
- Where your database and files are stored
- Automated test suites every change must pass
- 300+
- Automated test suites every change must pass
- Scripts loaded from outside servers
- 0
- Scripts loaded from outside servers
- In Trash before a deleted record is gone for good
- 30 days
- In Trash before a deleted record is gone for good
How it is protected
What keeps your data safe
Many small business tools load code from other companies' servers on every page, so a problem on one of those servers can reach every page that loads from it. NameCRM is built the other way, and every change to it is checked before it ships.
No code from outside servers
Every piece of code NameCRM runs in your browser comes from our own servers, at a version we chose and checked. Your browser refuses code from anywhere else.
Technical detailScripts are self hosted at exact, pinned versions, downloaded from the official npm registry with integrity checked, each with a Subresource Integrity hash so a changed copy is refused. A Content Security Policy blocks scripts from any other origin; in a real browser test, an injected outside script was blocked on every page.
Every change is checked before it ships
No change to NameCRM goes live until it passes automated checks. A change that tries to add code from an outside source is refused, and every code change carries a written security review.
Technical detailOver 300 automated test suites must pass before release. A supply chain check refuses any new third party script. A written security review is required on every code change.
Each account sees only its own data
The rules that decide who can read what are enforced by the database itself, so one account cannot read another account's data.
Technical detailRow level security (RLS) policies in the Postgres database.
Two-step sign-in for staff
Staff accounts can turn on two-step sign-in. With it on, a password alone is not enough to get in: a code from their authenticator app is needed too.
Technical detailTime based one-time passcodes (TOTP) from an authenticator app.
Encrypted while it travels
Information is encrypted while it travels between your browser and NameCRM.
Technical detailEncryption in transit over HTTPS (TLS).
AI that does not train on your data
NameCRM's AI features, including drafting, assistants, the AI phone receptionist and transcription, use Anthropic, Deepgram and ElevenLabs. We have set each of these providers so that the content we send them is not used to train their models.
Technical detailThe setting on each provider, and where each one runs, is listed on our AI trust page. See the AI trust page
Data residency
Where your data lives
Your records are stored in Canada. The servers that run the application are in the United States, and information passes through them on the way to the database. Our privacy policy says the same.
Database and file storage
Canada (Montreal)Supabase
Region ca-central-1
Application servers
United StatesVercel
Runs the application and its server functions
Every feature
Every security and reliability feature
Each card is one feature, in the words of NameCRM's own feature records, running every day in our own agency. The sections above say what they add up to; these are the parts.
Security and access19 features
Two-step sign-in
An authenticator code is required at every sign-in once enrolled, enforced by the database on 73 tables and by the server, not just the login screen.
What sets it apartTwo-step enforced at the database layer, not only in the interface.
Switch modules on and off
An owner or admin switches whole modules off in Settings, which hides them everywhere, refuses their server requests and keeps the data; seven of the 23 built modules switch today, the rest stay on.
What sets it apartA CRM built as sellable modules from the database up.
Access control in the database
Every business table and file store is locked by row-level security inside the database itself, so the app's own checks are a second layer, not the only one.
Roles and permissions
Owner, admin, staff and viewer roles are mapped to 18 capabilities, the browser and server copies of the map are proven to agree across 756 test cases, and every private server route is tested as a stranger before release.
Invitation only
Public sign-up is off, so team members join only by invitation and approval.
Idle lock and sign out everywhere
Sessions lock when idle, passwords can be changed in place, and one button signs you out on every device.
Every outside login sealed
Every stored connection to Microsoft, Google and QuickBooks is encrypted at rest with AES-256-GCM, and a gate refuses code that would store one unsealed.
No vendor trains on your audio
Every call and meeting sent for transcription carries the opt-out that stops the speech vendor training on your clients' audio.
Your books never reach the AI
Nothing from your accounting reaches the AI, deal values stay out of the meeting brief, the briefing and the weekly review, and tests keep it that way.
Public form shield
Public forms combine a hidden trap field, a minimum fill time, a server-signed token, a small proof of work, first-party origins and per-visitor rate limits.
Text abuse guard
Texts set off by a public booking, contest or workshop form go only to Canadian numbers, so a stranger cannot use those forms to run up international texting charges.
Independent security sweeps
A three-part security sweep of access, rendering and the data layer closed 25 findings in one day, each verified from outside, and security headers refuse clickjacking.
Only running code is served
Production serves only the files the app runs, so internal documents, tests and registries are never reachable on the web.
Safe demo mode
Demo mode shows the CRM to a prospect with zero real client data on screen and blocks every write, then returns every real record untouched.
Your data is yours
One click exports your contacts, companies, deals, engagements, payments, tasks, notes, appointments, letters, campaigns and recent emails and texts as a zip of spreadsheet files, with a list of your files, and no cell can run as a formula.
Outside words marked as material
Text from outside, in an email, voicemail, call or web page, is marked for the AI as material, not orders, and code checks that a figure or promise in a call recap is one your side really said.
Client files behind signed links
Invoices, signed letters, attachments and card scans sit in private storage, texts and the app open them only through signed links, and one change cuts off every link at once.
A second security sweep
In October eight separate AI review passes swept access, the phone line, payments, the client portal and public forms; each fix was proven against the old code, and our records showed no sign a hole had been used.
Private details masked before AI reads
Before AI drafting, summaries or briefings read your messages, notes and meetings, NameCRM finds and masks card numbers, social insurance numbers, passwords, sign in codes, door and alarm codes, birth dates and clients' private links written in them.
Reliability and testing16 features
425 automated test suites
425 automated test suites guard the code, one gate runs them all before each release ships, and a new check is only trusted after it has been seen failing.
128 real browser test harnesses
128 harnesses drive the real app in a real browser, from composing an email to taking a quote, and read the screen rather than trusting the code.
2,689 commits since August 2026
NameCRM has had 2,689 commits since August 1, 2026, and our own business runs on it every day.
Independent review before money ships
Changes touching money, sign-in or client data get an independent adversarial review before release, and every finding is checked in code before it is fixed.
Every file owned by a module
Every file and table belongs to exactly one module in a registry, and a release is refused if anything is unowned or doubly owned.
Every send is awaited
A gate refuses any email that is fired without waiting for it, because a send nobody waited for may never leave.
Integration health in plain words
Every outside connection, calendar, mail, QuickBooks, phone and Stripe, is judged ok, warn or down in one plain sentence, with a bell before a client ever notices.
Health check and error telemetry
A health endpoint checks the database, mail, storage and job queue, and errors in any user's browser are captured and reviewable in Settings.
One job scheduler
One scheduler runs everything that happens later, from scheduled sends to backups, with retries and backoff, and a job can never run twice.
Nightly backups
Every business table is copied to private storage each night and kept 30 days, with Back up now and written restore steps, and a release is refused while a new table is neither backed up nor excluded with a reason.
Trash and exact undo
Deletes go to a 30-day trash and every action has an 8-second undo that restores exactly, including linked records.
Live on every device
Changes appear on every open device without a reload or losing what you are typing, and an open thread catches up anything the connection missed.
Opens instantly
The app repaints your last session's data in about 3 milliseconds before any network call, and long lists render only what is on screen.
Update ready prompt
When a new version ships, an Update ready button shows what it changes and how many changes are waiting, and loads it in one click; an older version left open cannot send an agreement.
Dates in your time zone
Every date is the day on your screen in your own time zone, so quotes no longer expire at 5 pm and dates never print a day early.
Readable contrast
Text on coloured buttons meets the WCAG AA contrast standard on all 44 surfaces, measured rather than eyeballed, in light and dark themes.
Retention
How long we keep things
Deleting something in NameCRM has a clear, written outcome.
You delete a record
It moves to Trash and is permanently deleted after 30 days.
An account closes
Its data is kept for 90 days so the account can be reopened with everything in place. After 90 days it is deleted.
Invoices and payment records
Kept for 6 years, as Canada Revenue Agency rules require.
The rules we follow
- BC's Personal Information Protection Act (PIPA) governs how we handle personal information in British Columbia
- Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) applies when information crosses a provincial or national border
- Commercial email and text messages sent through NameCRM follow Canada's Anti-Spam Legislation (CASL)
- Our privacy policy names a Privacy Officer, Seemab Akbar, who takes any question or request about your information
Written by the Nametech Canada team. The sections on this page were checked on September 28, 2026; the feature list is printed from NameCRM's own feature records, last checked on November 8, 2026.