Security
Your data, on your own server.
Every builder runs on a separate server. Every request passes through layers of protection before it reaches your data.
HTTPS onlyTLS 1.2 and 1.3, HSTS
Guardrails at the edgeRate limits, upload caps, security headers
Sign-inHashed passwords, two-factor codes, revocable sessions
Permissions on every requestRole, module and action, plus scheme by team
Your own serverSeparate application and database for each builder
What protects you
Secured at every layer.
Each item below is built into BuilderCRM today.
Isolation
- A separate server for each builder, with its own application and database
- Files stored per builder in Amazon Web Services storage in Mumbai
- Chat files can only be attached inside their own conversation
Encryption
- HTTPS only, with TLS 1.2 and 1.3 and HSTS
- Files encrypted at rest by Amazon S3
- File links are signed and expire after one hour
- Passwords stored only as bcrypt hashes
Sign-in and access
- Two-factor sign-in with an authenticator app
- Sessions can be revoked, and signing out disconnects live connections
- Permissions checked on every request, by role, module and action
- Teams decide which schemes each person can see
Guardrails
- Rate limits on the API and on uploads, with a 10 MB upload cap
- Security headers against clickjacking and content sniffing
- Requests validated before they reach the database
- Link previews refuse private network addresses
AI with limits
- The assistant is read-only and uses your permissions
- Phone, email, PAN, Aadhaar and bank numbers are masked
- A daily question limit per person and a monthly company allowance
Accountability
- Changes to leads, bookings, payments and ERP documents are logged
- Cheques and DDs released against a one-time WhatsApp code, stored only as a hash
- Application errors are monitored
Found a security issue? Please report it to hello@buildercrm.in.
DPDP Act, 2023
Built to support your DPDP duties.
Under India’s Digital Personal Data Protection Act, 2023, your company is the Data Fiduciary for the personal data of your leads and customers. BuilderCRM processes that data on your behalf and gives you the controls to look after it.
Meeting the Act also depends on your own notices, consent and processes. BuilderCRM supports them; it does not replace them.
- Personal data kept on your own server, never shared with another builder
- Documents and files stored in India, in the AWS Mumbai region
- Access limited by role, module and scheme, so people see only what their work needs
- Records can be corrected by authorised users, and changes are logged with who and when
- Phone, email, PAN, Aadhaar and bank numbers masked in AI answers
- Lists can be exported, so you can answer a request for a person’s data
Your data, under your control.
See how BuilderCRM keeps every builder on its own server.