Data security in Atut CRM
Atut CRM protects data with organisation isolation, access control and an event log. We describe only what actually works in the system, including the tools that help with GDPR obligations.
Data protection
How we protect data in the system
Safeguards work at the level of data, sign-in, files and permissions. Many of them are checked by automated tests.
Organisation isolation
Every record query is limited to your organisation, even if someone supplies another organisation’s identifier. Automated tests check this for every data type.
Per-person permissions
Permissions are checked on every server route, not only in the interface. The “own records only” scope hides other people’s records.
Passwords and sign-in
Passwords must have at least 10 characters, are stored as hashes (Argon2id or bcrypt), and login attempts are rate-limited. You can also sign in with a Connect account or a QR code.
Sessions and devices
A session expires after 2 hours idle and 12 hours after sign-in. “Remember me” lasts up to 30 days, on at most five devices, and ends when the password is changed.
Attachments
Only selected file types are allowed, checked by content. Files have random names, are stored outside the public directory and are downloaded only through access control.
Event log
Sign-ins, consent changes, team additions and other events are recorded in a log available to people with the permission. The retention period is configurable.
Protection against common attacks
Every write request needs a CSRF token, the interface does not insert data as HTML, and a CSP policy restricts script sources. Database queries are prepared, not built from text.
Safe export
CSV export neutralises dangerous characters in cells, so a spreadsheet will not execute an injected formula.
Team and access
The system administrator sees counts and teams. Customer data of an organisation is exported or deleted only as an explicit action that is written to the log.
GDPR
A GDPR-ready CRM: tools for the data controller
Your organisation is the controller of customer data and Partner IT Polska is the processor. Atut CRM gives you tools to handle the most common requests.
- Marketing consent records the date and source, and every change goes to the event log.
- Right of access: the “Download person’s data” button exports a contact’s data as JSON.
- Right to erasure: “Anonymise” removes a contact’s personal data, while deals and history remain without it.
- Retention: the event log retention period is configurable, and old entries are cleaned up automatically.
- Export and deletion of an entire organisation’s data is carried out by the system administrator as an explicit, logged action.
- Processing agreement: the rules for processing customer data on behalf of your organisation are set out in a data processing agreement (Article 28 GDPR).
- The account cache (name, email, job title) is cleaned after 30 days without a refresh.
- Shared responsibility: the tools support compliance, but do not replace procedures in your company or legal assessment.
Optional
Team password vault
A plug-in for organisations where the system administrator enables it. It has its own safeguards, independent from the rest of the CRM.
Encryption
The vault database is encrypted (AES-256), and its key is derived from the master password with Argon2id. The file is stored outside the public directory.
PIN and lockouts
Each person has their own PIN. Wrong attempts cause ever longer lockouts, and after many attempts a hard lock until an administrator unlocks it.
Roles and log
Roles: view, edit, manage, vault administrator. The access log has a hash chain that detects attempts to hide traces.
The vault is not a substitute for securing the user’s computer: malware on a device can capture revealed passwords.
FAQ
Questions about security and GDPR
Is Atut CRM GDPR compliant?
Atut CRM provides features that help you meet GDPR requirements: marketing consents with date and source, personal data export, contact anonymisation, an event log and access control. Compliance as a whole also depends on how your organisation uses the system and on your procedures.
Who has access to my customers’ data?
People in your team, within their permissions. The system administrator sees counts and teams, and can export or delete an organisation’s customer data only as an explicit action recorded in the log.
How do I delete a person’s data on request?
On the contact record choose “Anonymise”. Personal data disappears, while deals and history remain without it. If the person asks, you can first download their data as JSON.
Can I sign a data processing agreement?
Yes. A processing agreement (Article 28 GDPR) sets out the rules for processing your organisation’s customer data. To get one, contact us.
Get your sales organised before your competitors do
Create an account and use Atut CRM free for 30 days. Your team can start working today.