Encryption
All traffic to and from the Service is encrypted with TLS. Data is encrypted at rest in our database and file storage. Passwords are hashed — never stored in plain text.
Tenant isolation
MadagascarCRM is multi-tenant. Every record is scoped to an organization, and we enforce isolation in two independent layers: the application filters every query by organization, and the database enforces row-level security as a backstop. One company can never read another company’s data.
Access control
- Role-based permissions (owner, admin, sales, dispatcher, foreman, viewer).
- Authentication backed by Supabase Auth with secure session handling.
- Internal access to production data is limited to a need-to-know basis.
Infrastructure
The Service runs on trusted, SOC-2-aligned infrastructure providers — Supabase for data, Render for the API, and Vercel for the web app — each operating in hardened, monitored environments with automated backups.
Payments
Payments are processed by Stripe, a PCI-DSS Level 1 provider. Full card numbers never touch our servers.
Backups & availability
Databases are backed up automatically with point-in-time recovery, so your data can be restored in the rare event of a failure.
Reporting a vulnerability
We welcome responsible disclosure. If you believe you’ve found a security issue, email security@mdgcrm.com and we’ll respond promptly. Please give us a reasonable chance to address it before any public disclosure.