Identity and Access Management Standards
Unique system accounts are required to access any of Salesbuildr's supporting infrastructure. User accounts are unique and identifiable to an individual user. Access to privileged accounts on the databases and servers supporting the application is restricted to authorised personnel based on job responsibilities.
Passkeys or Two-factor authentication and strong password controls are required for administrative access to all systems.
Salesbuildr Platform Access and Authentication
The Salesbuildr platform is accessible via encrypted HTTPS sessions to ensure confidentiality and integrity of sessions. Salesbuildr products' authentication is managed through Microsoft SSO or Google SSO utilising their underlying MFA policies.
Secure development practices
Our development follows industry-standard secure coding guidelines, such as those recommended by OWASP.
Vulnerability Disclosure
We use a combination of tools for a comprehensive vulnerability scanning strategy across our codebase, dependencies, database and infrastructure. We use of Azure Security Center, Google Cloud Security Scanner and Elasticsearch Security to monitor for vulnerabilities and improvements.
If there's a vulnerability in our application, we want to know about it. We are interested in fixing vulnerabilities and we are grateful for security researchers who notify us of their findings. Please use support@salesbuildr.com to bring anything to our attention.
Hosting Infrastructure
Our physical infrastructure is hosted and managed in a ISO 27001, SOC 1 & SOC 2, PCI Level 1, FISMA Moderate and SOX certified data centres.
Google Firebase region Netherlands and Germany
Authentication, Database, Storage
Microsoft Azure region West Europe (Amsterdam, Netherlands)
Azure App Service and SSL Certificates
Elastic-search region Germany
Elasticsearch Service
We rely on the appropriate physical and logical security controls at the corresponding facilities to protect equipment and information from unauthorised access.
Information on the Google certifications can be found here.
Information on the Microsoft Azure certifications can be found here.
Information on the Elastic certifications can be found here.
Information on the Sentry certifications can be found here.
Information on the Intercom certifications can be found here.
Vendor management program
Salesbuiildr has a vendor management program in place. Components of this program include:
Critical third-party vendor inventory
Vendor's security and privacy requirements
Review of critical third-party vendors at least annually
Data Processing and Storage
To be able to send quotes for products and services to customers, Salesbuildr collects and processes data as shown below.
Processor | What data | Purpose |
Full Name, email address of external (your customers) and internal (your employees) contacts | Create and send proposals to customers | |
Full Name, email address of external (your customers) and internal (your employees) contacts | Search capabilities | |
Full Name, email address of external (your customers) and internal (your employees) contacts | Error logging | |
Full Name, email address of internal (your employees) contacts | Support capabilities |
How Data flows between your PSA and Salesbuildr
After enabling the integration with your PSA, Salesbuildr will perform an initial syncronisation to pull in your users, companies, contacts, products, services and labour. Once connected, opportuinties you create will be syncronised to Salesbuildr so you can create quotes that are linked to the opportunity. Salesbuildr can create, but does not syncronise quotes from your PSA.
Salesbuildr Entity | Action | PSA Entity |
Users | Salesbuildr can read from your PSA | Users |
Companies | Salesbuildr can read, create and update | Companies |
Contacts | Salesbuildr can read, create and update | Contacts |
Products | Salesbuildr can read, create and update | Products |
Services | Salesbuildr can read, create and update | Services |
Labour | Salesbuildr can read from your PSA | Labour |
Opportunities | Salesbuildr can read, create and update | Opportunities |
Quotes | Salesbuildr can create | Quotes |
Data Encryption
Data Encryption: All data transmitted between Salesbuildr and Autotask is encrypted in transit using TLS 1.2 or higher, to protect the data from interception. Data stored within our system is also encrypted to ensure its integrity and confidentiality.
Data Separation
Each customer is assigned its own relational database schema within database instances.
Data Reliability
All persisted data is stored redundantly so that the loss of a single server or an entire availability zone should not result in data loss. All infrastructure is monitored for performance, availability, and reliability 24/7.
API Security
We apply best practices for API security, including rate limiting, to prevent our interfaces from being exploited for data extraction or DDoS attacks. In addition, all API calls are logged and monitored for unusual activities or anomalies.
Access to data
Who from Salesbuildr can access your data?
Support and development can access your customers data to support development and perform troubleshooting and will only do so for troubleshooting purposes or on your specific request. You can disable and access for Salesbuildr employees in your Salesbuildr instance under the companies tab by searching for Salesbuildr and the denying access.
Data deletion request
Should you ever want to move off our platform, we will completely remove your instance including all related data.
Usability Data
In order to provide our solutions and services to you, we must collect certain usage data. This helps us ensure that our solutions and services are operating correctly and that you are having the best possible experience with our products.
The types of Usability Data we collect include:
Device and connection data (e.g. browser type, operating system version, network speed)
User and system behaviour (e.g. commonly used features, user activity, configuration process, marketplace usage)
Product logs (e.g. web server and java logs for troubleshooting)
Organisational data (e.g. customer industry, location, number of users)
Other relevant machine data
We collect data about the solutions you use and how you use them, such as how often you access our products and which features you use most frequently. This is done in an effort to improve your experience with our solutions. For example, we may use this data to highlight additional capabilities or offer tips relating to features you are already using, to make our solutions more intuitive, or to enhance the solution’s most popular features.
Application security
Single Sign-On
Customers can use the single sign-on (SSO) functionality provided by the built in Google Firebase Authentication component that allows for SSO via Microsoft or Google accounts.
Role Based Access Control (RBAC)
Salesbuildr currently has two roles
Admin - Can access all functions in the application
User - Can create and edit opportunities, quotes and products
Admins can restrict users to only see their own opportunities and quotes.
Salesbuildr premium offers additional RBAC by setting linking roles and permissions to users.
Application Infrastructure
Salesbuildr works based on a frontend API that talks to the backend API to perform operations.
Change management
Salesbuildr applies a systematic approach to managing change so that changes to customer-impacting services are reviewed, tested, approved, and well communicated.
Prior to being deployed in production environments, new changes are:
Reviewed: Peer reviews of the technical aspects of a change are performed to proactively catch and correct code errors;
Tested: Changes are applied in testing environments to ensure they perform as expected and do not adversely impact performance; and
Approved: Oversight is provided to ensure changes are prioritised and agreed upon.
Changes are typically moved into production in a phased automated deployment. Rollback procedures are available in order to revert to a previous version if any failures occur.
Emergency changes to production systems that require deviations from standard change management procedures are associated with an incident and are logged and approved as appropriate.
Salesbuildr's Engineering team follow a formally documented Software Development Life Cycle process which is based on Agile and Scrum methodologies. This process includes peer code review, automated testing, and scenario testing to ensure quality and to identify security vulnerabilities prior to shipping.
Salesbuildr typically releases new code on a or biweekly basis using separate code, test, staging and production environments. See the release notes section for information about our latest updates.