Security
Security is a first-class feature of Kashiwade CRM. Here's how we protect your data and your customers' data.
Multi-tenant isolation
Every record is keyed to an organization, and every request is scoped to the authenticated organization. Role-based access control (admin / member / viewer) and granular API-key scopes enforce least privilege.
Authentication
Staff sign in with a passkey (your device's fingerprint, face or PIN) only — there are no passwords to reuse, leak or type into a fake sign-in page. The session is kept in an HttpOnly cookie and ends after seven days without activity. Programmatic access uses scoped API keys you can create and revoke. The customer portal uses short-lived, single-use links.
Watching over sign-ins
When someone signs in from a device we have not seen before, the account owner gets an email; adding or removing a passkey sends one too. Under Settings → Security each person sees the devices that are signed in and can sign out one or all of them. Admins can read the organization's sign-in history (180 days), sign a member out everywhere, and send a member who lost their passkey a link to register a new one. Exports, creating API keys, changing a member's role and other sensitive actions ask for the passkey again first.
Rate limiting and abuse protection
API keys are bounded by per-minute burst and monthly quota limits tied to your plan, and public endpoints (forms, surveys, chat) are rate-limited per IP. Sign-up and the customer portal sign-in are also protected by Cloudflare Turnstile bot checks.
Payment safety
Payments run through a PCI-compliant payment partner — we never store card numbers. Inbound payment and messaging webhooks are signature-verified and idempotent, so retries never double-charge.
Privacy by design
You can export any contact's full record and invoke the right to erasure, which anonymizes personal data in place. We avoid logging personal data, and an audit trail records who changed what.
Operational resilience
The platform runs on a global edge with a health probe, structured request logging with correlation IDs, and automated database backups.
Reporting an issue
Found a vulnerability? We appreciate responsible disclosure — email security@kashiwade.com and we'll respond promptly.