Security and your private server
Your client data sits on a server of its own, backed up every night and protected by the same controls we use for our own CRM.
Your private server
- Every customer gets a separate server – never a shared database with other customers.
- We set it up, keep it updated and watch it; you never have to touch a server.
- Call recordings and transcripts are stored on your server, not in a vendor's cloud.
Backups
- Nightly encrypted backups of the database, uploaded files and call recordings, kept for 14 days.
- An off-site copy in a separate location.
- An automatic test restore every week, so we know the backups work.
- Every update starts with a backup and can be rolled back.
Logins and access
- Roles: Super Admin, Admin, Manager, Sales Rep, Account Manager – each sees only what their role allows.
- Two-step login with an authenticator app, backup codes and "remember this device for 30 days"; can be required for Admins or everyone.
- Sign-in is locked for 15 minutes after 5 wrong passwords; changing a password ends other sessions.
- Data export, deleting permanently and other sensitive actions are for the Super Admin unless they give the right to someone.
- An audit log records every change by your team (who, what, when, from where) – entries cannot be changed.
Privacy tools
- Email consent per contact, with its date and source.
- Download one person's data, or erase it, in a few clicks.
- Retention rules that delete old data automatically, each one off until you switch it on.
- A public privacy-request form for copies, deletion or "stop emailing me".
- Recording-consent rules per country for calls.
Infrastructure
- HTTPS everywhere, with strict security headers.
- Rate limits and size limits on every request.
- Passwords hashed; connector keys, mailbox passwords, integration keys and two-step secrets encrypted; secrets never written to logs.
- Clients see only their own data in the portal.
Who can see your data
Your team, with the rights their roles give them, and your clients for their own records in the portal. We access your server only to run, update and back it up, or when you ask us for help.
Report a security problem
Found a weakness? Email support@rosespark.com with the details. We reply quickly and do not take action against honest reports.
Questions about your data? Ask on a demo call
We'll show you the security settings, the audit log and the privacy tools on a real CRM.