Security & trust
Your pipeline data, protected by design.
Pipemetry connects to your CRM, so we treat your data with care from the first byte: strict tenant isolation, encryption, an immutable access audit, and a SOC 2 program in progress.
- Shipped
Tenant isolation by design
Every customer’s data is isolated at the database layer with row-level security (RLS), force-applied on every customer-plane table. Queries are scoped per tenant, so one customer can never read another’s pipeline.
- Shipped
Encryption in transit; secrets & backups encrypted at rest
All traffic is served over TLS. CRM credentials and other secret material are encrypted at rest, and backups are encrypted at creation — a backup that cannot be encrypted is never written. Full-datastore at-rest encryption is on our roadmap. Secrets are managed out of band and never committed to source.
- Shipped
WORM access audit
Read- and write-path access is recorded to a write-once, read-many (WORM) audit log retained for compliance. Workspace admins can review their own workspace’s audit trail — and download it as CSV — directly in Settings, so you can prove who accessed what, and when.
- Shipped
Authentication & two-factor (2FA)
Sign-in is handled by a managed identity provider, and every request is verified against signed OIDC tokens before it reaches your data. Workspace admins can require two-factor authentication for every member — enrollment with an authenticator app happens at the next sign-in, and admins can see each member’s enrollment status.
- Enterprise / on request
Enterprise SSO / SAML
Federating Pipemetry with your own identity provider (SSO / SAML) is an Enterprise offering we set up on request — talk to sales to scope it for your team.
- In progress
SOC 2
We are building toward SOC 2. Controls are being implemented and evidence collected; we will share status — and, once available, our report — with Enterprise prospects under NDA.
- Shipped
Backups & resilience
Customer data is backed up on a regular schedule so it can be restored. We design for least-privilege access to production systems.
- Shipped
API keys — scoped and hashed
Programmatic access uses per-workspace API keys that only a workspace admin can mint. A key is shown once and stored only as a SHA-256 hash — Pipemetry can never reveal it again — and every call is rate-limited and scoped to the member’s permissions.
- Shipped
Signed, guarded webhooks & exports
Outbound webhooks are delivered as HMAC-signed event envelopes so your endpoint can verify they came from Pipemetry, and delivery is guarded against server-side request forgery (SSRF). Spreadsheet exports for Google Sheets or Excel use signed, scoped, expiring tokens rather than open URLs.
- Shipped
Shareable board snapshots, safely
Public board share links are unguessable, read-only and frozen point-in-time — set to expire in 30 days, revocable at any time, and marked noindex so they never appear in search results.
Subprocessors & data handling
We keep a current list of the third parties that process data on our behalf. See our subprocessors and privacy policy for details on what we collect and how it is handled. Our Data Processing Addendum — including the EU Standard Contractual Clauses — is incorporated into our terms for every customer, with countersigned copies available on request.
The Service is hosted in the United States.
Responsible disclosure
We welcome good-faith security research on pipemetry.com and app.pipemetry.com. If you believe you have found a vulnerability, email [email protected] with enough detail to reproduce it. We aim to acknowledge reports within 3 business days and to keep you informed while we remediate.
Safe harbor: security research conducted in good faith and consistent with
this policy is authorized under our Terms of Service, and we will
not pursue or support legal action against you for it. In return we ask that you: make a
good-faith effort to avoid privacy violations, data destruction, and service degradation; test
only against accounts and workspaces you own; never access, modify, or retain data belonging
to another tenant — if you encounter it, stop and report immediately; avoid social
engineering, phishing, and physical attacks; and give us a reasonable period (90 days) to
remediate before public disclosure. We do not operate a paid bounty program at this time, but
we are happy to credit reporters. This policy is referenced from
/.well-known/security.txt on both hosts.
Security FAQ
How does Pipemetry keep my data separate from other customers?
Pipemetry enforces tenant isolation at the database layer using row-level security (RLS), force-applied on every customer-plane table, plus per-tenant query scoping. One tenant cannot read another tenant’s data.
Is Pipemetry SOC 2 compliant?
SOC 2 is in progress. We are implementing controls and collecting evidence, and will share status and (when available) our report with Enterprise prospects under NDA.
Is my data encrypted?
Data is encrypted in transit (TLS). Your CRM credentials and other secret material are encrypted at rest, and backups are encrypted at creation. Full-database at-rest encryption is on our roadmap.
Can I get an audit log of access to my data?
Yes. Pipemetry keeps a WORM (write-once, read-many) access audit covering read and write access paths, retained for compliance. Workspace admins can review the trail and download it as CSV directly in Settings — no request needed.
Can I require two-factor authentication (2FA) for my team?
Yes. A workspace admin can require 2FA for all members from Settings. Members are asked to set up an authenticator app at their next sign-in, admins can see each member’s enrollment status, and turning the requirement off never removes an authenticator someone already set up.
Do you support SSO?
Enterprise SSO / SAML federation with your own identity provider is available on request as part of an Enterprise plan. Contact sales and we will set it up with you.
Does Pipemetry have an API, and is it secure?
Yes. A workspace admin mints a per-workspace API key that is shown once and stored only as a SHA-256 hash; every request is rate-limited and scoped to the member’s permissions, so a key can only ever read what that member can. Outbound webhooks are HMAC-signed and SSRF-guarded, and spreadsheet export links use signed, scoped, expiring tokens.
How do you secure public board share links?
A shared board is a frozen, read-only snapshot behind an unguessable link with a 30-day expiry, revocable at any time and marked noindex so it never appears in search results. It is a point-in-time copy, not a live view of your data.
Need a security review?
Enterprise plans include a security & compliance review and a named contact. Get in touch and we will share what you need — or email [email protected].