Start free trial Book a demoBook demo
Trust & security

Your customer data stays yours — isolated, controlled and auditable.

How Subul CRM separates workspaces, controls who sees what, handles AI and protects your data. Items marked [CONFIRM] or [PLACEHOLDER] are still being finalised.

Tenant isolation

Every company works in its own isolated workspace.

All customers share the same application services, but every request, query and background job is scoped to one tenant. A workspace can never read another workspace’s records.

Select a tenant to trace its path.
TENANTS
ISOLATED WORKSPACES
Nile Heights workspacetenant_id = nh_0142
Riverside workspacetenant_id = rd_0388
[Tenant C] workspacetenant_id = tc_0517
SHARED LARAVEL SERVICES Global tenant scope on every query
API & web app Queue workers Automation engine AI service File storage Search index
Services are shared; data access is not. A missing tenant scope fails closed and the request is rejected.
Access control

Least privilege by default, down to individual fields.

Roles

Agent, team leader, manager and admin roles out of the box, plus custom roles with granular permissions.

Managed in Settings → Roles & permissions

Record scopes

Each role sees only its own records, its team’s, or everything — applied to lists, search, reports, exports and the API alike.

Own · Team · Department · All

Field-level permissions

Hide or lock sensitive fields such as budget, national ID or medical notes per role, everywhere they appear.

Hidden fields never leave the server
RoleRecordsBudget fieldExport
AgentOwnView—
Team leaderTeamEditTeam
Sales managerAllEditAll
MarketingAll (read)HiddenAggregates
Example configuration · sample data
Authentication

Strong sign-in and controlled sessions.

Multi-factor authenticationAuthenticator-app codes for every user, and admins can make MFA mandatory for the whole workspace.
Single sign-on (Enterprise plan)SAML / OIDC sign-in with your identity provider on the Enterprise plan, with automatic deactivation when someone leaves.
Session managementConfigurable idle timeouts, a list of active devices per user, and one-click sign-out of all sessions.
Encryption

Encrypted in transit and at rest.

In transit All traffic between browsers, mobile apps, the API and our services uses TLS 1.2 or higher. [CONFIRM with infrastructure]
At rest Databases, backups and uploaded files are encrypted at rest (AES-256) by our hosting provider. [CONFIRM with infrastructure]
Audit logsSample data
Sign-ins, exports, permission changes, merges and deletions are recorded with who, what and when. Admins can filter and export the log.
10:42 Hossam Exported 240 leads (CSV) Export
10:15 Admin Changed Karim H. to team leader Role
09:58 Nour A. Signed in from a new device · MFA passed Sign-in
09:30 Support Access request — declined by admin Access
AI data handling

AI works for your team — within your permissions.

Never trained on your data Your records, notes and prompts are not used to train AI models — ours or our providers’. [confirm with legal]
Scoped to permitted records AI only sees records the requesting user is allowed to see. Hidden fields are removed before any prompt is built.
Never computes official metrics Conversion rate, contact rate and revenue are calculated by the reporting engine from your data — never by AI.
Human approval AI suggestions show confidence and source text, and nothing is written to a record until a person approves it.
Healthcare privacy mode

Extra protection for clinics and patient data.

When enabled, phone numbers and clinical notes are masked by default, revealing them is logged, and AI features skip clinical fields entirely.

Sample record at Riverside Dental Clinic · simulated
Backups & recovery

Backed up continuously, tested regularly.

Recovery point objective (RPO) [PLACEHOLDER] Maximum data loss window in a disaster.
Recovery time objective (RTO) [PLACEHOLDER] Target time to restore service.
Backup frequency [PLACEHOLDER] Automated, encrypted database backups.
Backup retention [PLACEHOLDER] How long backups are kept before deletion.
Compliance

Certifications and frameworks

Subul CRM does not claim any certification on this page. Each status below is to be confirmed, and a certification will only be listed once it has been formally issued.
ISO/IEC 27001 Information security management system. [IN PROGRESS / TBD]
SOC 2 Type II Independent audit of security controls. [IN PROGRESS / TBD]
GDPR Data processing terms for EU data subjects. [IN PROGRESS / TBD]
Egypt PDPL (Law 151/2020) Personal data protection obligations in Egypt. [IN PROGRESS / TBD]

Subprocessors

SubprocessorPurposeLocationData processed
[SUBPROCESSOR]Cloud hosting & database[REGION]All workspace data
[SUBPROCESSOR]Transactional email[REGION]Name, email address
[SUBPROCESSOR]AI model provider[REGION]Permitted record text in prompts
[SUBPROCESSOR]Error monitoring[REGION]Technical logs, user ID
Placeholder list — the final subprocessor list will be published before general availability.

Responsible disclosure

If you believe you have found a security vulnerability in Subul CRM, please tell us privately. We will acknowledge your report, keep you updated and credit you if you wish.

Security contact [email protected] Please do not access other customers’ data or disrupt service while testing.
Request a security review

Frequently asked questions