Unique system accounts are required to access any of Salesbuildr's supporting infrastructure. User accounts are unique and identifiable to an individual user. Access to privileged accounts on the databases and servers supporting the application is restricted to authorised personnel based on job responsibilities.

Passkeys or Two-factor authentication and strong password controls are required for administrative access to all systems.

The Salesbuildr platform is accessible via encrypted HTTPS sessions to ensure confidentiality and integrity of sessions. Salesbuildr products' authentication is managed through Microsoft SSO or Google SSO utilising their underlying MFA policies.

Our development follows industry-standard secure coding guidelines, such as those recommended by OWASP.

We use a combination of tools for a comprehensive vulnerability scanning strategy across our codebase, dependencies, database and infrastructure. We use of Azure Security Center, Google Cloud Security Scanner and Elasticsearch Security to monitor for vulnerabilities and improvements.

If there's a vulnerability in our application, we want to know about it. We are interested in fixing vulnerabilities and we are grateful for security researchers who notify us of their findings. Please use support@salesbuildr.com to bring anything to our attention.

Our physical infrastructure is hosted and managed in a ISO 27001, SOC 1 & SOC 2, PCI Level 1, FISMA Moderate and SOX certified data centres.

We rely on the appropriate physical and logical security controls at the corresponding facilities to protect equipment and information from unauthorised access.

Salesbuiildr has a vendor management program in place. Components of this program include:

To be able to send quotes for products and services to customers, Salesbuildr collects and processes data as shown below.

After enabling the integration with your PSA, Salesbuildr will perform an initial syncronisation to pull in your users, companies, contacts, products, services and labour. Once connected, opportuinties you create will be syncronised to Salesbuildr so you can create quotes that are linked to the opportunity. Salesbuildr can create, but does not syncronise quotes from your PSA.

Data Encryption: All data transmitted between Salesbuildr and Autotask is encrypted in transit using TLS 1.2 or higher, to protect the data from interception. Data stored within our system is also encrypted to ensure its integrity and confidentiality.

Each customer is assigned its own relational database schema within database instances.

All persisted data is stored redundantly so that the loss of a single server or an entire availability zone should not result in data loss. All infrastructure is monitored for performance, availability, and reliability 24/7.

We apply best practices for API security, including rate limiting, to prevent our interfaces from being exploited for data extraction or DDoS attacks. In addition, all API calls are logged and monitored for unusual activities or anomalies.

Support and development can access your customers data to support development and perform troubleshooting and will only do so for troubleshooting purposes or on your specific request. You can disable and access for Salesbuildr employees in your Salesbuildr instance under the companies tab by searching for Salesbuildr and the denying access.

Should you ever want to move off our platform, we will completely remove your instance including all related data.

In order to provide our solutions and services to you, we must collect certain usage data. This helps us ensure that our solutions and services are operating correctly and that you are having the best possible experience with our products.

The types of Usability Data we collect include:

We collect data about the solutions you use and how you use them, such as how often you access our products and which features you use most frequently. This is done in an effort to improve your experience with our solutions. For example, we may use this data to highlight additional capabilities or offer tips relating to features you are already using, to make our solutions more intuitive, or to enhance the solution’s most popular features.

Customers can use the single sign-on (SSO) functionality provided by the built in Google Firebase Authentication component that allows for SSO via Microsoft or Google accounts.

Role Based Access Control (RBAC)

Salesbuildr currently has two roles

Admins can restrict users to only see their own opportunities and quotes.

Salesbuildr premium offers additional RBAC by setting linking roles and permissions to users.

Salesbuildr works based on a frontend API that talks to the backend API to perform operations.

Salesbuildr applies a systematic approach to managing change so that changes to customer-impacting services are reviewed, tested, approved, and well communicated.

Prior to being deployed in production environments, new changes are:

Changes are typically moved into production in a phased automated deployment. Rollback procedures are available in order to revert to a previous version if any failures occur.

Emergency changes to production systems that require deviations from standard change management procedures are associated with an incident and are logged and approved as appropriate.

Salesbuildr's Engineering team follow a formally documented Software Development Life Cycle process which is based on Agile and Scrum methodologies. This process includes peer code review, automated testing, and scenario testing to ensure quality and to identify security vulnerabilities prior to shipping.

Salesbuildr typically releases new code on a or biweekly basis using separate code, test, staging and production environments. See the release notes section for information about our latest updates.