Trust

Security at PipeBase

The controls we have in place to keep your customer data safe. We describe only what is actually shipped — no aspirational claims.

Authentication

  • Passwordless one-time codes generated with a CSPRNG, stored only as salted SHA-256 hashes, single-use with a 10-minute expiry.
  • Brute-force protection: per-account attempt limits plus IP + email rate limiting.
  • Session tokens are random 256-bit values, stored only as hashes; revocable per-session or all-at-once.

Encryption

  • All traffic served over TLS with HSTS enforced.
  • Sensitive third-party credentials encrypted at rest with AES-256-GCM authenticated encryption.
  • Secrets managed in AWS Secrets Manager — never in source or plaintext config.

Tenant isolation

  • Every workspace’s data is scoped to its tenant on every query; identifiers are derived from the authenticated session, never from client input.
  • Deletes and exports are tenant-scoped.

Auditability

  • A customer-visible audit log records security-relevant events — sign-ins, user and API-key changes, and deletions.
  • Field-level change history on contacts, companies, and deals.
  • Administrative access is logged and time-boxed.

Data & backups

  • Managed Postgres with point-in-time recovery.
  • API access via revocable, hashed API keys with least-privilege scoping.

Reliability

  • Zero-downtime deploys with database migrations gated ahead of release.
  • Health and readiness probes, structured logging with request tracing, and error monitoring.
  • Graceful shutdown that drains in-flight requests.

Access controls

  • Role-based administration for workspace configuration and user management.
  • Request, header, and database timeouts to contain slow or abusive traffic.

Questions from your security team?

We’re happy to walk through our controls and complete security questionnaires.

Contact us

Back to PipeBase