Security
How we protect your workspace
This page describes the protections that are in MetriCRM today. Features marked as Enterprise add-ons need to be turned on for your workspace.
Your data, kept apart
- Every workspace has its own database; one customer's records are never stored with another's.
- Workspace databases and application servers run in Singapore.
- Each workspace has its own address, and a sign-in to one workspace never works in another.
Encryption
- All traffic to MetriCRM uses HTTPS.
- Credentials you connect — mailbox passwords, API keys, access tokens and authenticator secrets — are encrypted with AES-256-GCM before they are stored, bound to your workspace.
- Field-level encryption (Enterprise add-on): mark custom fields such as NRIC numbers sensitive to keep them encrypted, masked everywhere and revealed only with a recorded reason.
Sign-in protection
- Passwords are hashed with Argon2id and checked against known breached passwords.
- Two-factor sign-in with an authenticator app, required by default for admin and manager roles.
- Accounts lock after repeated failed attempts, and sessions end after a period without activity.
- Sign-in anomaly alerts: a new country or impossible travel, bursts of failed attempts and admin sign-ins from a new device are flagged to the person and their admins.
Access control and audit
- Roles and permissions down to the field, with own / team / all record scopes.
- An audit log of changes, exports and support access that your admins can review and export.
- Admins can see and end sessions, revoke remembered devices and sign everyone out.
- IP allowlist (Enterprise add-on): allow access only from your networks, with stricter ranges per role.
- Audit log streaming (Enterprise add-on): send your audit log to your own SIEM over a signed HTTPS webhook.
AI with your data policy
- Personal data is replaced with placeholders before text is sent to an AI model, under your workspace's data policy.
- Fields you mark “never send to AI” — and every sensitive field — are left out of AI requests.
- We don't train models on your data. You can bring your own AI provider key.
Operations
- Availability is measured every 5 minutes against our 99% monthly commitment.
- Our own security and audit logs are kept for 12 months.
- If a personal data breach affects your workspace, we tell your administrators within 48 hours.
Privacy
- We follow Malaysia's Personal Data Protection Act 2010 and act as your data processor under our Data Processing Agreement.
- Your workspace keeps its own retention settings, and you can export your data at any time.
Compliance and sub-processors
We map our controls to ISO/IEC 27001 and the SOC 2 Trust Services Criteria to prepare for future audits. MetriCRM is not certified under either today. The companies that process data on our behalf are listed on our sub-processor page.
Report a security issue
Found a vulnerability? Please email us with the details and we'll respond as soon as we can: support@metricrm.com