Naffes
العربيةStart free↗

Naffes

Security and compliance at Naffes CRM

Customer data is the most valuable thing you put into a CRM. This page explains exactly how Naffes CRM protects it: encryption, access control, auditing, backups and the standards we follow.

Last updated2 min read

Certifications and standards

  • ISO 27001: information security management.
  • SOC 2: security, privacy and availability controls.
  • Saudi Personal Data Protection Law (PDPL): we process personal data under the Saudi law; see the privacy policy.
  • Availability: 99.99% service uptime.

Encryption

Data is encrypted in transit with TLS 1.3 and at rest with AES-256. Encryption at rest covers the most sensitive secrets specifically: integration and API keys, OAuth tokens, connected mailbox passwords, Meta tokens and two-factor secrets.

Each workspace keeps its integration credentials in its own isolated key space, and secret fields are never sent back to the browser after saving: the interface only shows that a value is set, and when.

Access control

  • Two-factor authentication: each user can turn it on with an authenticator app and gets one-time recovery codes. How to enable it.
  • Single sign-on: sign in with Google or Microsoft, with SAML SSO for Okta and Azure AD.
  • Role-based access: every workspace starts with four roles (Owner, Manager, Member and read-only Viewer), each with its own view and edit rights.
  • Safe impersonation: when the owner signs in as a teammate to troubleshoot, they cannot change that teammate's password, two-factor setup or API tokens.

Audit and accountability

The audit log shows workspace admins who did what, to which record, and when. Its CSV export includes the old and new value of every changed field, and the export itself is recorded in the log.

Backups and deployment options

  • Daily backups: a full backup of the database and uploaded files every night, with the last seven kept.
  • Managed cloud: run entirely by the Naffes team.
  • Self-hosting: for organizations that need Naffes on their own servers, deployed by our team.

Your data is yours

  • We do not sell personal data or use it for targeted advertising.
  • The workspace owner can export the workspace's data.
  • Processing, retention and your rights are covered in the privacy policy.

For security questions or compliance documents, email hello@naffes.net.

Start your free trial