Security at Krezor
Understand how access, hosting and integrations affect the protection of your business information. We help define the controls and responsibilities for your Krezor deployment.
A PRACTICAL SECURITY OVERVIEW
A CRM brings customer details, conversations and business activity together. Protecting that information requires more than a login screen. It involves the application, its infrastructure, the connected services and the people using it.
Give people the access their work requires.
Krezor CRM supports role-based permissions and configured lead visibility for managers and sales users. Lead deletion can be restricted to reduce accidental loss. Access rules should be reviewed when people join, change roles or leave.
Protect information throughout its journey.
HTTPS protects information in transit when correctly configured. Database, disk and backup encryption need their own configuration. The hosting plan should identify where data is stored, who can access it and which protections are enabled.
Define protection at each layer.
Hosting security includes operating system updates, network access, application configuration and administrative accounts. Firewall rules, service exposure and remote access requirements are reviewed for the deployment rather than assumed from the hosting provider alone.
Connect systems with clear boundaries.
CRM integrations use credentials and permissions to access agreed data. The integration scope should define authentication, field mapping, validation and any request limits. Credentials need secure storage, rotation when required and removal when a connection is no longer used.
Plan how information can be restored.
A backup plan should cover the database, uploaded files and configuration needed to restore the service. Frequency, retention, storage location and restore testing are agreed for the deployment. Backup creation alone does not establish a recovery time or guarantee that a restore will succeed.
Keep security part of maintenance.
Customisations and integrations need review alongside the application they extend. Deployment planning should include validation, dependency updates and a recovery or rollback path. Security testing and independent assessments can be included in the project scope.
Know what to review when something goes wrong.
Available application and infrastructure logs can support investigation of errors and suspicious activity. Monitoring coverage, log retention, response contacts and escalation arrangements need to be agreed. This page does not promise continuous monitoring or a fixed response time.
Make ownership of each control clear.
Hosting, email, automation and messaging providers have their own security practices and account controls. Provider selection and integration planning should consider the data exchanged, permissions, retention and relevant contractual terms. Third-party certifications do not automatically certify Krezor.
This overview describes product capabilities and deployment considerations. It is not a control audit. Confirm the enabled protections, support coverage and responsibilities for your specific service before sharing sensitive information.
CUSTOMER CONTROLS
REPORT A SECURITY CONCERN
Send a report to hello@krezor.com with the subject Security report. Include the affected page or product, a description of the issue and the approximate time you observed it.
If you can reproduce the issue safely using your own account or test data, include the steps and a redacted screenshot. Do not include passwords, secret keys or other people's personal information.
Do not access other customers' records, change or delete information, or disrupt a service to demonstrate a finding. Contact us before any further testing that could affect users or systems.
This reporting channel does not authorise security testing or establish a bug bounty programme. Any permission for testing must be agreed separately.
SECURITY QUESTIONS
This page does not claim ISO 27001 certification, SOC 2 attestation or an independent security audit for Krezor. If your procurement process requires these, contact us to discuss the evidence required before making a decision.
No. Hosting, access policies, encryption, backups and monitoring depend on the product and agreed deployment. Ask for the controls that apply to the specific service you are evaluating.
Self-hosted deployment can be discussed for Krezor CRM. The implementation scope should identify who manages the server, updates, backups, access and recovery.
No. Security controls, regulatory requirements, uptime commitments and recovery targets must be reviewed for the specific service and documented in the relevant agreement.
Email hello@krezor.com with the product, deployment and requirements you are evaluating. We can discuss the relevant configuration and available documentation. Please do not send passwords or confidential datasets.