Your pipeline is the business. We treat it that way.
Naya CRM is multi-tenant by design, which means isolation can't be an afterthought. Here's exactly how your data is separated, encrypted, accessed and audited.
Tenant isolation
Every table is scoped by organisation and enforced with row-level security in the database — not just in application code.
Encryption
TLS in transit, encryption at rest, and third-party credentials sealed with an application-managed key.
Role-based access
Admin, Dev, Manager and BDR tiers. Roles live in a dedicated table and are checked server-side, so they can't be escalated from the client.
Secrets handling
API keys and OAuth tokens never reach the browser. Model calls, enrichment and payments all run behind the server boundary.
Webhook verification
Every inbound webhook — payments, messaging, meetings — is signature-verified before a single row is written.
Auditable changes
Stage moves, deal events, billing changes and migrations are all logged with actor and timestamp, and imports can be rolled back.
AI and your data
Naya only sends the content needed to answer a request to our AI providers, and those providers are contractually barred from training public models on it. Prompts, system instructions and tools stay on the server; nothing sensitive is exposed to the browser.
Nothing Naya drafts is sent to a customer automatically — a human approves every outbound message, proposal and agreement.
Found a vulnerability?
Report it privately to security@appetitetech.com. We investigate every report and will keep you updated.