Security & Trust
Your customers trust you. You can trust us.
Ayidhu CRM holds some of your most valuable information: your customers, your deals and your conversations. Here is how we keep it private, protected and under your control.
- HTTPS everywhere
- AES-256 encryption at rest
- Isolated per organization
- Role-based access
- Malware-scanned uploads
- Full audit trail
How we protect your data
Security is built into every layer, from the network your data travels over to who can see a single field.
Encrypted in transit and at rest
Every connection to Ayidhu uses HTTPS, and browsers are told never to fall back to plain HTTP. Your records and files are encrypted at rest with AES-256, and connection secrets for your integrations are encrypted again before we store them.
Your organization, walled off
Each organization’s data is kept separate. Every request is checked against the organization of the person making it, so one customer can never see or change another customer’s records. Record IDs are random and cannot be guessed.
Trusted sign-in
Sign-in is handled by a dedicated identity provider, so we never see or store your password. Every request carries a signed, short-lived token that is verified before anything is read or changed, and idle sessions are signed out automatically. Administrators can require two-factor authentication for every member of the organization.
Least-privilege access
Administrators decide what each role can see and do, object by object: create, read, edit, delete and export. Record ownership and sharing rules limit who sees which records, and page layouts can hide fields from roles that don’t need them. Reports, forecasts and AI answers only count records the person can open. API keys act as one member with exactly that member’s access, are stored only as hashes, and can be read-only, expiring and revoked at any time; webhook payloads are signed so you can verify they came from us.
A full audit trail
Creates, edits and deletes are recorded with who made the change, when, and what changed. Administrators can review this history at any time to answer “who touched this record?”
Safe file handling
Every uploaded file is scanned for malware before anyone can download it. If a file cannot be scanned, it stays blocked rather than being passed through unchecked.
Standards
Built on proven, open protocols
We don’t invent our own cryptography. Ayidhu relies on the same widely reviewed standards that protect online banking and the world’s largest cloud services.
HTTPS / TLS
Encrypts all traffic between your browser, our API and our providers. TLS 1.3 is supported.
HSTS
Instructs browsers to only ever connect over HTTPS, preventing downgrade attacks.
OAuth 2.0 & OpenID Connect
Industry-standard protocols behind user sign-in and the integrations you connect, such as e-signature, so you never share passwords with us.
Signed tokens (JWT)
Every API request is authenticated with a cryptographically signed, expiring token.
AES-256 encryption
Protects stored data, files and integration secrets at rest.
Signed webhooks
Messages from our payment and communications providers are verified by signature before we act on them.
Enterprise-grade infrastructure
Ayidhu runs on Cloudflare’s global network, which absorbs denial-of-service attacks and filters malicious traffic before it reaches the application. Each request runs in its own isolated environment.
Your records live in a managed PostgreSQL database with continuous backups and point-in-time recovery. Your files live in encrypted object storage. Our providers are established infrastructure companies with their own independent security programs.
How we operate
- Secrets and keys are kept in a managed secret store, never in source code
- Support staff can view your account only to help with an issue. Access is time-limited, revocable and logged
- Organization isolation and permission checks are covered by automated tests
- Rate limits protect the API and public endpoints from abuse
- Technical error details are logged for our team and never shown to your users
- We keep an internal register of security findings and track each one to resolution
Your data, your control
From sign-up to sign-off
01
You own your data
Your records belong to you. We use them only to provide the service. We never sell them, share them with advertisers, or use them to train AI models.
02
Export at any time
Build a report on any object and download it as a CSV file whenever you need to.
03
Clear deletion
After you cancel, your data is kept for 30 days so you can export it. After that, your records and stored files are permanently deleted.
04
Payments kept separate
Card details are entered in our payment provider’s secure checkout and never reach our servers.
Security is a partnership
We secure the platform. You control who uses it. A few habits go a long way:
- Give each person the least access their role needs
- Remove users promptly when they leave your team
- Review the audit trail for unexpected changes
- Use strong, unique passwords for your sign-in
Common questions
Which third parties process my data?
Cloudflare (hosting, file storage, email delivery and the built-in AI model), Neon (the PostgreSQL database), Clerk (sign-in) and our payment processor (Paddle, the default merchant of record). Only if you turn them on: Twilio for calls, SMS and WhatsApp, DocuSign for e-signatures, and Anthropic or OpenAI when you add your own AI key — those run under your own account with that provider.
Where is my data hosted?
Ayidhu CRM runs on Cloudflare’s global network, which provides DDoS protection and traffic filtering. Your data is stored in a managed PostgreSQL database with continuous backups, and files are kept in encrypted object storage.
Can other Ayidhu customers see my data?
No. Every organization’s data is isolated, and every request is checked against the organization of the signed-in user before any data is returned.
Can Ayidhu staff access my data?
Only when needed to help you with an issue. Support access is limited to a short session, can be revoked, and every session is logged.
What happens to my data if I cancel?
Your data is kept for 30 days so you can export it. After that it is permanently deleted, including stored files.
Do you store credit card numbers?
No. Payments are processed by our payment provider in its own secure checkout, and card numbers never reach our servers.
How do I report a security issue?
Email security@ayidhu.com with a description and steps to reproduce. We aim to acknowledge reports within 24 hours.
Responsible disclosure
Found a security vulnerability? We take all reports seriously. Please email security@ayidhu.com with a description of the issue, steps to reproduce it, and the potential impact.
We aim to acknowledge all reports within 24 hours and resolve confirmed vulnerabilities within 14 days. We do not pursue legal action against good-faith security researchers.
Have a security questionnaire?
Our team is happy to walk your IT or compliance reviewers through how Ayidhu protects your data.