Security
Last updated: June 6, 2026. Draft — review before publish.
See also: Privacy policy
Overview
Clefmark is a multi-tenant SaaS platform. Each organization's data is isolated by orgId. This page summarizes how we protect tenant data on app.clefmark.com.
Tenant isolation
All tenant documents include an orgId. API routes verify the actor's organization and role before reading or writing CRM, inbox, playbook, or automation data.
Client applications cannot read or write tenant collections directly. CRM and inbox access is API-first via the Admin SDK.
Encryption
Data is encrypted in transit using TLS. Data at rest is encrypted by our cloud infrastructure providers.
OAuth tokens for email and integration credentials are stored encrypted using server-side keys.
Authentication
Product access uses Firebase Authentication. Sessions are validated on every API request via Bearer tokens.
Role-based access applies within each organization: org admin, manager, and rep scopes.
OAuth and integrations
Email mailboxes connect via OAuth (Gmail, Microsoft 365, Zoho). Clefmark stores tokens needed to sync and send on behalf of your organization.
You can disconnect integrations from Admin or user settings. See our privacy policy for subprocessors.
Outbound communications
Email, SMS, and print mail sends are audited. Outbound activity is logged for compliance and team visibility where applicable.
Marketing site
clefmark.com does not store CRM or tenant data. Optional analytics cookies on the marketing site require consent. See our cookie policy.
Security contact
Report security concerns to hello@clefmark.com. We review reports promptly.