Is our channel data safe with you? The security questions, answered

Sooner or later a security team — yours, or your customer's — asks the uncomfortable question: where do the reseller org charts, rep contact details, and account-ownership records actually live, and who can see them? That data is some of the most sensitive in your business, and any tool asking to hold it — including ours — owes you a straight answer before you upload it. Here is the short version of ours; the full detail lives on our trust center.

Your data stays yours: tenant isolation

Every record carries the ID of the organization it belongs to, and every query the server runs is scoped to your organization. Workspaces never share data, down to the caching layer — cache keys include the organization ID, so one tenant's data can never be served to another.

Encryption everywhere

Connections use TLS 1.3 in transit. Data is encrypted at rest with AES-256 on managed Postgres. Secrets are kept out of source control.

Identity and access

Authentication is handled by Clerk: hashed passwords, multi-factor authentication, and passkeys. Enterprise plans add SAML single sign-on with the major identity providers and SCIM provisioning for automated joiner / mover / leaver. Inside an organization, access follows least-privilege roles — Admin, Member, and Viewer.

Audit logging, on by default

Privileged actions — sign-in, import, export, role change — are written to an immutable, per-organization ledger that records the actor, the action, the IP address, and structured metadata. Retention is configurable, and the log exports to CSV when a security team asks for evidence.

Compliance posture

We keep our current compliance status — what is ready and what is in progress — on the security page so it stays accurate. If your procurement team has a questionnaire, that page is the place to start, and we are happy to fill in the rest.