Security
This page sets out what is in place today. It only describes things we have checked in the product itself — if something isn’t listed here, don’t assume it.
Sign-in
- Delta CRM and Delta Knowledge use Sign in with Google, handled by Auth0.
- Delta Schedule, Delta Projects and Delta Learn use Sign in with Google, handled by Firebase Authentication.
- Other sign-in methods, such as SAML single sign-on or Microsoft accounts, aren’t available.
Permissions
- In Delta CRM, what each person can see and do is set by a role permission matrix, with overrides for individual users.
- The CRM’s server checks permissions on its API routes, and an automated test fails the build if a route has no permission guard.
- Project members in Delta Projects are owners, editors, commenters or viewers.
Records of activity
- Delta CRM keeps an activity log of changes, and data exports need permission and are recorded.
Connected accounts
- Access tokens for connected services — Gmail, HubSpot, Google Analytics, Google Ads and Aircall — are stored encrypted in the CRM database.
- Gmail access is limited to reading and sending mail.
Hosting
- Delta CRM and Delta Knowledge are hosted on Google Cloud in Sydney, Australia.
- Delta Schedule, Delta Projects and Delta Learn run on Google Cloud and Firebase; their app servers are in the United States.
- Google Cloud encrypts the data it stores by default.
- You can’t currently choose where your data is hosted.
AI features
- The knowledge-base assistant only sends the model the articles it retrieved for that question, and ticket notes are redacted of personal details before they are used to draft articles.
Third parties
The services that process data on our behalf are listed in the Privacy Policy.
See the list of subprocessorsReporting a security issue
If you think you’ve found a vulnerability, email security@example.com. Please include enough detail for us to reproduce it, and give us a reasonable chance to fix it before sharing it publicly.