Nutaan LogoNutaan CRM
Enterprise Grade

Security at Nutaan CRM

How we protect your workspace on the web and in our Android and iPhone apps — what we collect, why, who can see it and how you delete it.

Encryption

Data is encrypted in transit with TLS and at rest with AES-256.

SOC 2 Compliant

We follow strict security procedures and controls to keep your data safe.

Secure Infrastructure

Hosted on world-class cloud providers in private networks with 24/7 monitoring.

GDPR

We adhere to GDPR: you can access, export, correct or delete your data at any time.

HIPAA

We adhere to HIPAA safeguards for health-related information: encryption, role-based access and access logging.

Delete in the app

Delete your account and data from inside the Android and iPhone apps or the web dashboard.

Account and sign-in

  • Passwords are stored only as salted hashes; nobody at Nutaan can read them.
  • Sign in with email, Google, Microsoft or LinkedIn. Provider sign-in uses OAuth, so we never receive your provider password.
  • The app keeps its sign-in key in the phone's secure storage (Android Keystore / iOS Keychain). Signing out or deleting your account revokes it on our servers.
  • Facebook, Instagram, LinkedIn and YouTube are connected on the provider's own permission screen, and can be disconnected at any time.

Workspace isolation and roles

  • Every record belongs to one workspace, and access is checked on the server for every request.
  • Owners decide what each team member can see. Members work their assigned leads, with phone numbers and emails masked unless the owner allows otherwise.
  • Members call and message customers through the company line, without seeing the customer's number.
  • Lead-intake keys for portals and website forms can only add leads; they cannot read your data.

Mobile app permissions

The Android and iPhone apps ask for a permission only when a feature needs it, after explaining why. Every permission is optional — you can say no and keep using the CRM.

Contacts (optional)

Only when you tap “Pick from phone contacts”. The app reads the name, phone number and email of the single contact you choose. Contact photos and your full address book are never read or uploaded. Details are saved only after you tap Save.

Microphone (optional)

Only during a direct company-number call, so your customer can hear you. Never used in the background.

Notifications (optional)

Lead assignments and work alerts. You turn them on yourself; the app works fully without them.

Not requested

Location, camera, photos and media library, SMS, call logs, screen overlay and writing to your contacts. The app does not track you across other apps or websites and shows no ads.

Data use and sharing

  • We use your data only to provide the CRM features you use. We do not sell personal data or use it for advertising.
  • We share data only with providers that run the service for us — cloud hosting, email delivery, calling and telephony, push notification delivery — and with Meta, Google, LinkedIn or WhatsApp only when you connect them.
  • Google user data is handled under the Google API Services User Data Policy, including its Limited Use requirements.

Retention

  • Workspace data is kept while your account is active and removed when you delete the account.
  • Incoming-message previews in Message activity are kept for 14 days.
  • One-time sign-in and connection links expire within minutes and work only once.
  • Payment and invoice records are kept only as long as tax and accounting law requires.

Delete your account and data

In the Android or iPhone app

Account → Delete my account and data → type DELETE. Deletion happens immediately.

On the web

Dashboard → Profile → Delete My Account. The same data is deleted.

Can't sign in?

Follow the data deletion instructions and we delete it within 14 days.

Deleted: your profile and sign-in, leads, contacts, notes, call history, messages, campaigns, attendance, connected accounts and notification tokens. An owner deleting their account also removes their team workspace. Kept: payment, invoice and commission records the law requires.

Operations

Access controls. Only authorised personnel can reach production systems; access is logged and audited, and two-factor authentication is enforced for all internal access.

Audits and testing. We run regular security reviews and penetration tests, and code changes are reviewed before deployment.

Incident response. If a security incident affects your data, we notify affected customers and authorities within the timelines the law requires, including GDPR's 72-hour rule.

Children. Nutaan CRM is a business tool and is not intended for children under 16.

Report a vulnerability

Email business@nutaan.com with the subject “Security report”. Please do not access other customers' data or disrupt the service while testing. See also our Privacy Policy and Terms.