Hosted in Québec · 2FA · daily encrypted backups
Security and data protection Your data.
Security and data protection Your data.
Hosted in Québec.
Hosted in Québec, Canada. Daily backups encrypted with a key I do not keep on the server. A separate database for every client. Two-factor authentication mandatory on every account. What I do, described plainly.
Hosting in Québec
The server is in a datacentre in Québec, Canada, behind a CDN and a web application firewall. Payment, email delivery and site protection rely on providers that may process data outside Canada; they are named in the Privacy Policy.
- Datacentre: Québec, Canada
- HTTPS on every connection (TLS 1.2 / 1.3)
- Geo-blocking on public pages: North America + EU only
- External uptime monitoring every 5 minutes
Protecting your clients' information
Tools built into the CRM to manage the personal information you hold about your clients.
- Per-channel consents on every contact (email, SMS, phone), dated
- Consent flag for marketing campaigns
- Change log on your records: who changed what, and when
- Excel or CSV export of your contacts and companies
Electronic signature
Designed around the principles of Quebec's LCJTI: who signed, their explicit consent, and a timestamped proof emailed to the signer. What the LCJTI says, article by article
- Unique 256-bit link per signer, no account needed
- Proof PDF: timestamp, IP address, browser, SHA-256 fingerprints
- Rate-limited: 30 views / 5 submissions per minute per IP
- Single-use: once signed, the link cannot sign again
Two-factor authentication — mandatory
One-time codes from any standard authenticator app. Mandatory on every account — like your bank, but for your CRM.
- Google Authenticator, Microsoft, Bitwarden, Authy, 1Password
- 8 single-use recovery codes
- Fixed 14-day period to set it up
- Lost device: recovery codes
Encrypted backups
Daily backups on three levels, encrypted before they leave the server. The passphrase is kept outside the hosting infrastructure.
- Daily encrypted database backups (AES-256)
- 7 days on the server + 30 days in an Ontario datacentre
- 40-character passphrase kept outside the hosting infrastructure
- Restore procedure documented and tested
One database per client
Each client has its own database, with its own credentials limited to that database. Checked in an internal audit.
- Dedicated database + dedicated credentials per client
- 32-character random passwords
- Automated cross-client access tests
- A separate application instance per client
Things I do without advertising them.
- Automated dependency vulnerability scans (Composer audit + Dependabot)
- Monthly automated kernel patches + reboot
- Weekly security report sent to the administrator
- Daily OS security updates applied automatically
- Web application firewall + geo-blocking on public pages
- External uptime monitoring every 5 minutes
- Additional access protection on admin surfaces (one-time PIN)
/ faq
Security — common questions
Where exactly is my data stored?
The database and uploaded files are hosted in Québec, Canada. Daily encrypted backups are kept in a datacentre in Ontario. Some services I rely on — payment processing, email delivery, site protection — may process data outside Canada; they are named in the Privacy Policy.
Is the data encrypted?
In transit, yes: every connection uses HTTPS (TLS 1.2 or 1.3). Backups are encrypted with AES-256 and a 40-character passphrase kept outside the hosting infrastructure, so a stolen backup is unreadable. The live database relies on server access controls rather than disk encryption.
Can other clients see my data?
No. Each client has its own database, with its own credentials limited to that database. Even if one client's credentials leaked, they would only open that client's data. This isolation was checked in an internal audit and is covered by automated tests.
What 2FA options are supported?
TOTP codes from any standard authenticator app: Google Authenticator, Microsoft Authenticator, Bitwarden, 1Password, Authy. 8 single-use recovery codes are generated on enrollment. 2FA is mandatory for every account, with a fixed 14-day period to set it up.
Which tools help me protect my clients' information?
Per-channel consents on every contact (email, SMS, phone) with the date they were recorded, a consent flag for campaigns, a log of changes to your records, Excel or CSV export of your contacts and companies, and mandatory 2FA for your team.
What about backups — can I restore?
Yes. Backups run every day in three layers: 7 days on the server, 30 days in an Ontario datacentre, and an optional off-network copy for 14 days. The restore procedure is documented and has been tested.
How are passwords stored?
Hashed with bcrypt, never reversible: I cannot see your password. A reset uses a single-use link sent to your email. If you lose your 2FA device, the recovery codes are the way back in.
What if there's a security incident?
I notify affected clients as soon as possible. The change log helps establish what was modified, when and by whom, and backups kept in another region allow a restore even if the production server is compromised.
Are you SOC 2 / ISO 27001 certified?
No — those certifications are costly and aimed at larger organizations. I apply the controls described on this page (encrypted backups, least-privilege access, change logs, mandatory 2FA, dependency scanning, weekly security reports), without a third-party attestation.
Do you have a public security report?
Not on a public page yet. I share transparency notes on request (uptime, security patches applied, incidents if any): email info@crmpme.ca.