Security and privacy engineered from the ground up

Veyra CRM is built on zero-external-dependency principles with defense-in-depth security, strict isolation, and full ownership of your customer data.

Zero Third-Party Telemetry

We do not inject third-party analytics scripts, session recorders, or ad trackers. Your proprietary prospect data, deals, and notes stay strictly between you and your database.

Hardened CSP & Headers

Strict Content Security Policy (CSP), clickjacking prevention (X-Frame-Options: DENY), MIME sniffing blocks, and CSRF origin verification safeguard every request.

Role-Based Access Control

Strict isolation between Owner and Member tiers. Sensitive actions — including API keys, billing management, and user provisioning — require explicit owner authorization.

Rate Limiting & Brute-Force Defense

Granular IP-based rate limiting on login attempts (10 per 10 minutes), meeting bookings (20 per hour), and global APIs prevents automated brute force and credential stuffing.

Formula Injection Neutralization

All spreadsheet CSV exports sanitize cell values against CSV formula injection attacks (prepending leading single quotes to formulas like =, +, -, @).

Cryptographic Webhook Verification

All Stripe billing webhooks verify cryptographic HMAC SHA-256 signatures with timestamp tolerance checks before any subscription state mutation is committed.

Lightweight, self-contained, and isolated

Veyra CRM is built on Node.js 22 LTS with built-in SQLite and fetch. By avoiding bloated NPM dependency trees, we eliminate supply chain attack surfaces.

Atomic SQLite Transactions: Guarantees data consistency across deal stages, stock decrements, and invoice sequences.
Isolated API Secret Storage: Third-party keys (Apollo, JustCall, Anthropic, Salesforce) are encrypted and never exposed in client bundles.
Automatic Session Invalidation: Password updates instantly terminate all active sessions across all devices.

Compliance & Data Rights

GDPR & POPIA Compliance: Full support for right-to-access and right-to-erasure workflows across prospect records.

Data Portability: Complete on-demand CSV data export across prospects, clients, meetings, and invoices.

Encryption: TLS 1.3 encryption in transit with strict transport headers and secure cookie flags.

Institutional InfoSec & Procurement Matrix

Key governance, compliance, and architectural verification details for enterprise security review teams.

Security Domain	Compliance Standard	Veyra Architectural Implementation	Status
Data Sovereignty	POPIA (South Africa) & GDPR (EU)	Tenant isolation, full right-to-be-forgotten erasure, zero cross-tenant training data usage	Verified
Cryptographic Standards	AES-256 & TLS 1.3	End-to-end transport encryption, strict HSTS, secure cookie flags, and HMAC SHA-256 webhook signatures	Enforced
Access Governance	Role-Based Access Control (RBAC)	Strict Owner vs. Member privilege gating; automatic session revocation on credential rotation	Enforced
Threat Mitigation	OWASP Top 10 Defense	Formula injection neutralization on all CSV exports; Content Security Policy (CSP); brute-force rate limiters	Hardened
Business Continuity	Disaster Recovery & Uptime	Automated SQLite WAL continuous replication; 15-minute RPO; 99.95% availability SLA guarantee	99.95% SLA