Security and data handling

Each organization's data is kept apart

Every organization's records are in one Postgres database, separated by row-level security. Every read and write made from a signed-in session is checked by the database itself: the person asking must be an active member of the organization the row belongs to, the organization must be active, and their role must allow it. A bug in a page cannot show one organization's customers to another, because the database refuses the rows.

Some work does not come from a signed-in session: requests made with an API key, shared plan and calendar links, and the background jobs that sync CRMs, deliver webhooks and send email. These run in our server functions with elevated access to the database, and each is limited to one organization in its code.

Row-level security is turned on for every table that holds customer data. Roles narrow access further inside an organization: a CSM sees only the customers in their own book, and only admins can manage CRM connections, API keys and webhooks.

Signing in

• Passwords are handled by our sign-in provider, Supabase Auth, and stored only as hashes.
• Two-step sign-in. Anyone can add an authenticator app on Your account, and is then asked for a code after their password. An admin can require it for everyone in the organization. The requirement is enforced by the database, so a password alone does not open the organization's data, through the app or around it.
• Deleting an account or an organization asks for the password again, and for the code when two-step sign-in is set up.
• Anyone can sign out of all their devices at once from Your account.
• Single sign-on (SSO) is not available yet. It will come with the Enterprise plan; talk to us about your identity provider and timing.

Encryption and secrets

• Every connection to csresults.app, to the database and to file storage uses HTTPS (TLS). The site sends Strict-Transport-Security, so browsers use nothing else.
• Our database and file storage providers encrypt the data they store at rest.
• CRM access tokens are kept in Supabase Vault, encrypted, and no one in your organization can read them back.
• API keys and private calendar links are stored only as SHA-256 hashes, so they cannot be read back from the database. A key is shown once, when it is made.
• Files are uploaded and downloaded through signed links that work for 5 minutes. An upload link is signed for the file's declared size, so nothing larger can be sent with it.
• Webhook calls are signed with HMAC-SHA256, so the receiving system can check they came from CSresults.
• Other sites cannot frame CSresults pages, which protects against clickjacking.

An audit log of who changed what

Organization admins have an audit log under Settings, Audit log. It records members added, joining, leaving, removed and deactivated, role changes, invitations sent and revoked, API keys made and revoked, webhooks added and removed, changes to organization settings (with old and new values), the two-step requirement, customers deleted, and every full data export. No one can edit or delete its entries from the app.

Changes made through our support console, to your members or to your organization's seats, storage, limits or status, are recorded there and marked as support, and your admins are notified when support adds or changes a member. A support member working inside your organization in the app is recorded by name, like anyone else, for the kinds of change listed above. Direct database access by our staff, described below, is not recorded in it.

Access by our staff

Our support console needs two-step sign-in. It shows organizations, their members and admins, and their seat and storage use, but not your customer records. For support to work inside your organization in the app, a member of our team has to be added to it, which your admins are told about and which the audit log records.

The people who run CSresults can also reach the database directly, to operate the service and fix problems. We do that only when the service needs it or when you ask us for help.

The CSresults product sends none of your data to an AI service. Our staff do use an AI coding assistant, Anthropic's Claude, to build and run the service, and it can read records from the database when they use it to fix a problem or answer a support request. It is listed with the subprocessors below. We do not use your data to train AI models.

Your data, under your control

• Export. An admin can download everything the organization has in CSresults from Settings, Data, as one CSV file per table in a ZIP. Uploaded files are downloaded from each customer's page. Secrets such as API key hashes and CRM credentials are left out of the export.
• Delete an organization. An admin can delete the organization from Settings, Data once nobody else is active in it, by typing its name. Access closes at once; a job that runs every minute then removes its records from the database, and uploaded files are removed from storage within about ten minutes after that.
• Delete an account. Anyone can delete their own account from Your account, or leave one organization and keep the rest.
• Shared plans. A customer's shared plan link can be switched off or replaced at any time, and stops working when the customer churns or the organization is suspended.

The Privacy Policy says what is kept after a deletion and how long logs are kept.

Backups

The database does not have point-in-time recovery, and we do not keep backup copies we could restore your data from. A deletion in CSresults is permanent: we cannot bring back a deleted customer, file or organization. Use Export everything to keep your own copy, and especially before you delete anything. We will update this page when backups are in place.

Where your data is

The database, sign-in and background functions run on Supabase in the United States, in Amazon Web Services' us-west-2 region (Oregon). Email is sent by Resend from the United States. Uploaded files are kept in Cloudflare R2; we have not yet confirmed its storage region, so ask us if you need it. The site is served through Cloudflare's worldwide network, and the site's analytics and error reports are held by Lovable, our host.

Subprocessors

The companies that process data for CSresults, and what each does:

• Supabase

  Purpose

  The database, sign-in, and the background functions that sync CRMs, deliver webhooks and send email.

  Data

  Everything stored in CSresults apart from uploaded files, and the records of sign-ins.

  Location

  United States: Amazon Web Services, us-west-2 (Oregon)

• Cloudflare

  Purpose

  Storage for uploaded files (R2), and the network the site is served through.

  Data

  Files your team uploads to customers; every page request passes through its network.

  Location

  Uploaded files: Cloudflare R2, storage region not yet confirmed, so ask us if you need it. Network: worldwide.

• Lovable

  Purpose

  Builds and hosts the web app, counts page visits, and captures errors in the page.

  Data

  Page addresses, the referring page, browser type and language, and error details.

  Location

  Where Lovable stores this data is not yet confirmed; ask us if you need it.

• Resend

  Purpose

  Sends email: sign-in and confirmation emails, invitations, daily and weekly summaries, and the progress updates your team sends to customers. Open and click tracking are off.

  Data

  Each recipient's email address and the content of the email, which Resend keeps in its sending logs.

  Location

  United States: us-east-1 (Virginia)

• Anthropic

  Purpose

  Claude, the AI coding assistant our staff use to build, maintain and support CSresults. The product itself sends no data to it.

  Data

  What our staff look at with it while fixing a problem or answering a support request, which can include records from the database.

  Location

  United States

• NixiHost

  Purpose

  Hosts the mailbox our support, sales, privacy and security email arrives in.

  Data

  The messages you send us and our replies.

  Location

  United States

• Google (Gmail)

  Purpose

  The mailbox our operations alerts go to: new sign-ups, requests for seats, storage or a plan, and paused email sending.

  Data

  The name and email address of whoever signed up or asked, the organization's name, and any note they added.

  Location

  Google's data centers, in the United States and elsewhere

Data goes to these services only when your organization connects them, under your own agreement with each:

• HubSpot. When an admin connects it: companies, deals, products, contacts and meetings come in; results, check-ins, progress updates, forecasts and expansion opportunities go back.
• Salesforce. When an admin installs the CSresults package: accounts, opportunities, products, contacts and events come in; results, check-ins, forecasts and expansion opportunities go back.
• Webhooks and the API. Events go to the addresses an admin adds (for example Zapier, Workato or Make), and systems holding an API key read and write through the API.
• Calendar apps. When someone subscribes to their CSresults calendar link, their calendar app (Outlook, Google Calendar, Apple Calendar) fetches it.

Email

• Progress updates go only to the people your team chooses, each as their own copy, with an unsubscribe link. An address that unsubscribes gets no more updates from your organization.
• To keep CSresults from being used to send spam, the app caps how many people an organization can email a day: progress updates to 25 people and invitations to 10 on the free plan or in an organization's first 14 days, with a higher cap on a paid plan, and at most 3 updates a day to any one customer.
• Daily and weekly summary emails carry a one-click unsubscribe link.

API and webhooks

• Each connected system gets its own API key, which an admin can revoke on its own. Each key may make 300 requests a minute.
• Webhooks go only to public HTTPS addresses, and every call is signed.

Availability

We do not publish an uptime figure or offer a service level agreement on the standard plans. We check scheduled jobs and failed background calls on an internal health screen.

Report a vulnerability

If you think you have found a security problem in CSresults, email support@revopsolutions.com with the subject “CSresults security report”. Tell us what you found and how to reproduce it. Please do not access or change other people's data, run tests that slow the service down, or share the problem publicly before we have fixed it. We will reply, and keep you informed while we fix it.

The same contact is published at /.well-known/security.txt.