Security & Trust

Your data. Locked down. Auditable.

Tenant isolation at the row level. Encryption in flight and at rest. Granular permissions. Audit logs on every write. No data mining. No 'AI training on your records.'

The fundamentals

The security work most CRMs handwave.

Encryption

TLS 1.3 + AES-256 at rest.

All traffic is HTTPS-only with HSTS. Database storage is encrypted at rest via AWS KMS. Secrets are rotated automatically.

Tenant isolation

Row-level tenant scoping.

Every customer-data table carries tenant_id. Every API call's queries are scoped to the authenticated session's tenant. Cross-tenant reads are architecturally impossible.

Authentication

Modern auth, with the boring parts done.

Email + password with rate limits and breach detection. OAuth (Google, Microsoft). MFA for owner roles. SSO + verified domains on Scale tier.

Permissions

Role-based + scoped + field-level.

Boolean perms grouped into roles. Scope modifiers (own/team/all) at the record level. Field-level read/write/hide per role + team.

Audit log

Every write, recorded.

Who changed what, when, and from where. Searchable, filterable, exportable. Retained for 12 months on Team, 24 on Scale.

Backups

Point-in-time recovery, 7 days.

Continuous WAL backups, encrypted, stored in a separate AWS account. Disaster recovery tested quarterly.

What we don't do

The decisions that should be obvious.

No data mining

Your data is yours.

We don't aggregate customer records for 'product insights.' We don't sell anonymized data. We don't train AI models on your contacts.

No third-party trackers

No Mixpanel, no Segment, no Pixel.

Our marketing site uses privacy-respecting analytics with no cookies. The app sends zero events to third parties.

No backdoors

Strkr staff can't see your data.

Support requires per-incident access grants. Every access is logged and surfaced to workspace owners. Audit trail of every internal lookup.

No retroactive data changes

What you save is what we store.

The format that lands in your records is the format that comes back. We don't 'enrich,' rewrite, or augment your records without your action.

Compliance roadmap

Where we are. Where we're going.

GDPR
Compliant today
Data residency in EU available on Scale. Right-to-delete handled via Anonymize flow.
SOC 2 Type II
In audit, target 2026 Q3
Pre-audit controls in place. Annual external audit cycle starting Q3 2026.
HIPAA
BAA available on Scale, 2026 Q4
Encryption + audit controls already meet the technical requirements. BAA agreements available later.
ISO 27001
Scheduled 2027
Process maturity for ISO certification on the 2027 roadmap.

Try it free. Bring your team next week.

No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.