Security and data protection
Your data belongs to your organisation only
We describe only what the CRM actually does. In plain language, with technical detail for your IT where it makes sense.
Separation of organisations
Every customer has their own organisation in the CRM. Its data is separated at database level.
Data separated directly in the database
Each customer organisation’s data is separated directly in the database. An organisation sees only its own data – the separation is enforced by the database, not just by the application.
The database verifies on whose behalf you ask
The application signs every organisation selection, and the database rejects a query without a valid signature. It is an additional safeguard in case of an error in the application.
Accounts and settings are protected by the database
The database rejects any change to an account, membership, email address or Google link that would break the separation of organisations. Organisation settings (service status, language, currencies, service termination) can be changed only by the organisation itself or by the operator – another organisation can neither change nor delay them.
One organisation’s problem does not stop the others
The server checks the database every minute. It ends a connection that would block the work of others and alerts the operator. A mail error in one organisation does not delay the mail of the others.
Login and accounts
Your organisation controls who gets into the CRM and how.
Email and password, or a Google account
You can log in with Google only using an account with the same verified email as you have in the CRM. This is checked at every login.
Invitation and your own password
A new user verifies their email through the link in the invitation and sets their password themselves. Passwords are stored only as a hash, never in readable form.
Attempt limit and login history
The number of failed login attempts is limited. An administrator sees the login history, including failed attempts.
Logins protected in backups too
A login (session) is stored in the database only as a hash and its content is encrypted. A login cannot be misused from a copy of the database or from a backup.
Company domains belong to their organisations
A company email address in another organisation’s domain cannot be used for a new account in the CRM.
Operation and backups
Data is not lost with a single click.
Backups every day
Backups are made every day and kept for 14 days.
Trash
Deleted items can be restored for a period the organisation sets (30–180 days, 90 by default). After that the data is deleted irreversibly.
Change history
Records show who changed what and when.
No third-party resources
The application does not load third-party scripts, fonts or analytics. We host the fonts ourselves.
Personal data protection (GDPR)
The CRM includes tools your organisation uses to meet its obligations as a data controller.
Data subject requests with deadline tracking
Access to data, data portability, erasure, rectification, restriction of processing, objection and withdrawal of consent.
Erasure from emails too
A person can also be erased from the emails stored in the CRM and in the CRM mailbox.
Suppression list
A list of people who do not want marketing communication. It is respected by the import, leads and mail.
Retention periods
The organisation sets the retention periods for emails and operational records (logins, visits, exports) within the limits of the product.
Export of all the organisation’s data
A single ZIP file: data, emails, attachments, history and trash.
Service termination with an export
After the service is terminated, the organisation’s data is erased irreversibly and the owners receive a confirmation.
Users know what is recorded about them
Every user has a page “What the CRM records about me”. Visit logging is optional, off in a new organisation, and users are informed when it is switched on.
Operator
A specific European company stands behind the service.
A European operator
Gradex CRM is operated by the Czech company GradexSoft s.r.o.
Data processing agreement
An agreement under Art. 28 GDPR is a condition for setting up every customer organisation. The CRM records the version and the date of signature; the name of the signatory is stored encrypted.
Separate product administration
Product administration at the operator (setting up organisations, service status) is separate from logging in to the CRM and protected by two-factor authentication. A product administration account does not open organisations’ business data in the application – companies, contacts, deals or emails in Mail.
Do you have questions from your IT or data protection officer?
Send them to us with your demo request. We will answer specifically.
Book a demo