Our Security Commitment
Your CRM contains your most valuable asset: your customer relationships. We understand the trust you place in us.
Compliance & Certifications
SOC 2 Type II
Verified security controls meeting rigorous industry standards for security, availability, confidentiality, and processing integrity.
GDPR Compliant
Full compliance with the General Data Protection Regulation for processing personal data of EU residents.
CCPA Compliant
Compliance with the California Consumer Privacy Act. We don't sell personal information.
HIPAA (Enterprise)
Business Associate Agreements (BAA) available for healthcare customers on Enterprise plans.
Request our SOC 2 report: security@atoncrm.com
Security Features
Multiple layers of protection for your data
Encryption in Transit
All data transmitted using TLS 1.3, the most secure transport layer protocol. HTTPS everywhere with certificate pinning.
Encryption at Rest
All stored data encrypted using AES-256. Database, files, and backups all encrypted with keys stored separately.
Infrastructure Security
Hosted on AWS with world-class physical security, firewalls, DDoS protection, and intrusion detection.
Application Security
Secure development practices, code reviews, static analysis, and regular penetration testing.
Access Controls
Multi-factor authentication, SSO/SAML, role-based permissions, and comprehensive audit logging.
Data Protection
Daily backups, point-in-time recovery, geographic redundancy, and full data portability.
Self-Hosted Option
For organizations with the most stringent security requirements, deploy atonCRM on your own infrastructure.
- Deploy on your own AWS, GCP, or Azure account
- Run inside your VPN or private network
- Data never leaves your infrastructure
- Meet any regulatory data residency requirements
- Include atonCRM in your security audits
Incident Response
24/7 monitoring and rapid response to security events
Detection
Incident identified through monitoring or report
Triage
Severity assessed, response team assembled
Containment
Threat isolated to prevent spread
Eradication
Root cause identified and eliminated
Recovery
Systems restored to normal operation
Review
Lessons learned, improvements implemented
In the event of a security incident affecting your data, we notify affected customers within 72 hours.
Security FAQs
Report a Vulnerability
If you believe you've found a security vulnerability in atonCRM, please let us know responsibly.
security@atoncrm.comWe respond within 24 hours and reward security researchers.