Security
How your data is protected
A plain description of how UpStack CRM separates workspaces, handles sign-in and treats the keys you connect.
Workspaces are separate
Every record belongs to one workspace. The database enforces this with row-level security, so one customer's data is not readable from another's account.
Sign-in
Passwords are handled by Supabase Auth and stored as hashes, never as plain text. You can add two-step verification to your login.
Roles for your team
Each person is an owner, an admin or a member, so people see and change only what their role allows.
Your provider keys
Keys for Stripe, email, text and AI are saved per workspace and used by the server when it sends a message or takes a payment.
Hosting
UpStack CRM runs on Vercel and stores data in Supabase. Traffic uses HTTPS, and Supabase encrypts stored data.
Your data stays yours
Export your contacts whenever you want. Deleted contacts go to a recycle bin before they are gone for good.
The demo is isolated
Each demo is its own temporary workspace with made-up data and no connected providers. It is deleted when the visitor leaves or after two hours.
Messaging rules
Unsubscribes and text opt-outs are saved on the contact and skipped on later sends. You remain responsible for having permission to message your contacts.
