Security is a first-class product concern at Gro Wing CRM. This page summarizes what we do to keep your data safe. For enterprise buyers, we can share our full security whitepaper under NDA — email info@growingcrm.com.
1. Infrastructure
- Cloud provider: Amazon Web Services, primarily Mumbai (ap-south-1) region for Indian customers; other regions available on Enterprise.
- Network: Private VPCs, security groups restricted by role, no direct public database access.
- Monitoring: Real-time alerting on production infrastructure 24/7.
2. Encryption
- In transit: TLS 1.3 for all customer traffic. HSTS enforced. Modern cipher suites only.
- At rest: AES-256 on all databases and backups.
- Secrets: Managed via a dedicated secrets manager, never checked into code.
3. Multi-tenant isolation
Every customer workspace runs on its own dedicated database — not row-level filtering. This eliminates an entire class of vulnerabilities where a query bug could leak data across tenants. It is our most important architectural safeguard.
4. Access control
- Employee access to production is limited to a small on-call rotation.
- All production access is logged and audited.
- Employees complete security training annually.
- Access is revoked within 24 hours of role change or departure.
5. Authentication
- Passwords are hashed with bcrypt (cost factor 12).
- Session cookies are HTTP-only, SameSite=Lax, and Secure in production.
- SSO / SAML available on Scale and Enterprise.
- 2FA (TOTP) available on all paid plans.
6. AI safety
- Customer Data is never used to train models.
- Prompts sent to LLM providers are stripped of unnecessary PII before transmission.
- AI voice recordings are stored encrypted and are auto-deleted after 90 days unless you choose to keep them.
- We contract with LLM providers under zero-data-retention terms where available.
7. Backups + disaster recovery
- Automated daily backups for all customer databases.
- Backups encrypted at rest, geographically replicated.
- Recovery Point Objective (RPO): 24 hours. Recovery Time Objective (RTO): 4 hours.
8. Compliance
- GDPR + India DPDP Act compliant — see the Privacy Policy and DPA.
- SOC 2 Type I in progress; targeting Type II certification within 12 months of launch.
- ABDM-integrated features follow all NDHM compliance requirements (relevant to sister product Engage).
9. Incident response
- Incidents affecting customer data are triaged within 4 hours, contained within 24 hours.
- Affected customers are notified within 72 hours as required by GDPR / DPDP.
- A public post-mortem is published for any material incident.
10. Report a vulnerability
If you believe you've found a security issue, please email info@growingcrm.com with reproduction steps. We respond within 48 hours. We do not currently offer a paid bug-bounty program but we publicly credit responsible reporters (with your permission).
This page reflects our security posture as of 2026. Enterprise buyers get a detailed security review + our latest audit report on request.