Security
How we protect your sales data
A plain description of what Zyrft does today. No marketing badges, just the measures that are in place.
Your workspace is isolated
- Every table is protected by row-level security in the database, so one company's records are never returned to another company's users.
- The workspace is always taken from your verified session, never from the browser request.
- Automated tests try to read other workspaces' data and must fail before any release.
Access follows roles
- Admins, sales managers and salespeople see what their role and visibility setting allow: own, team or company records.
- Our staff have no standing access to your workspace. An admin can grant time-limited, read-only support access and revoke it at any time; every grant is logged.
- Changes to records and settings are recorded in an audit log (Pro).
Sign-in and accounts
- An email address must be confirmed before anyone can sign in.
- Passwords are stored only as hashes by our authentication provider and checked against known data breaches.
- Sign-in, invitations and imports are rate-limited.
Infrastructure
- The database runs in the EU: Supabase, AWS region eu-west-1 (Ireland). The application runs on Vercel with its primary region in Dublin.
- All traffic uses HTTPS. Security headers (HSTS, content security policy, frame protection) are set on every page.
- Uploaded spreadsheets are limited to 10 MB, parsed on the server and never executed; exports are protected against formula injection.
Payments
- Payments run through Stripe Checkout and the Stripe billing portal. Zyrft never sees or stores card numbers.
- Billing events are received through signed, idempotent webhooks.
Your data stays yours
- Admins can export companies, contacts, opportunities and activities to Excel or CSV at any time.
- Every user can download their personal data and request account deletion under Settings → Privacy.
- If a subscription ends, the workspace returns to the Free plan. Nothing is deleted.
What we don't claim
Zyrft does not currently hold third-party security certifications (such as SOC 2 or ISO 27001) and does not offer an uptime guarantee. If your organisation needs a security questionnaire or a data processing agreement, contact us.
Found a security issue? Please report it privately through the contact page.
Your next deal deserves a clearer pipeline.
Start on the Free Forever plan today, and try Pro free for 14 days when your team is ready.