Security

Data Encryption Policy

Encryption in transit and at rest for Vertex CRM, including password hashing and Meta token encryption.

Reviewed August 2026

1. Purpose

Describe encryption controls for Vertex CRM data in transit and at rest.

2. In transit

Production deployments terminate TLS at the reverse proxy / edge. Clients should access the Service only over HTTPS. Internal service links on a single host may use localhost; external integrations (Meta Graph, SMTP, IMAP) use TLS where the remote endpoint supports it.

3. At rest

  • Passwords: stored using modern password hashing (bcrypt), never plaintext
  • Integration tokens: encrypted with AES-GCM derived from SECRET_KEY when configured; production must not run with an empty/default secret
  • Database volumes: protected by host/disk access controls; customers may request deployment-specific disk encryption details under NDA

4. Key management

SECRET_KEY, database credentials, and Meta app secrets are provided via environment variables / secret stores. Keys are not committed to the application repository. Rotation is performed during incident response or scheduled maintenance.

5. Limitations

Application-level field encryption is not applied to every CRM text field; protection relies on access control, TLS, host security, and token encryption for high-sensitivity secrets.

6. Related

Security hub · Access control · Privacy

Last updated: August 2026.

Get started Schedule demo