Security · SalesWin

Hosting and data residency

SalesWin runs on Amazon Web Services. The application is hosted in AWS US-East today, with EU customer data being migrated to AWS Ireland (eu-west-1). Customer data is logically isolated per tenant via PostgreSQL row-level security; no two customers can see each other's records.

Encryption

In transit: TLS 1.2+ for every connection, HSTS enforced on all SalesWin domains.
At rest: AES-256 on database storage and object stores. Backups are encrypted with the same key class.
Secrets: API keys and OAuth tokens are stored encrypted and never written to logs.

Access control

SalesWin uses Clerk for authentication. Customer accounts are scoped to a single tenant; staff access to production is restricted to named operators, gated by MFA, and logged. We do not access customer Salesforce data except where required to investigate a support ticket the customer has raised.

Sub-processors

The full sub-processor list lives in our Data Processing Agreement. In short: AWS (hosting), Stripe (billing), Clerk (auth), and the CRM you connect (Salesforce or HubSpot).

Vulnerability disclosure

If you believe you've found a security issue, please email security@saleswin.io. We aim to acknowledge reports within two business days. Machine-readable contact details are at /.well-known/security.txt.

Please give us a reasonable window to investigate and fix before any public disclosure. We won't pursue legal action against researchers who act in good faith and stay within the scope of this policy.

Contact