Security
Where your data lives, and who can reach it.
A CRM holds your buyers' phone numbers and what they can spend. This page says plainly how that is stored, who can see it, and what we have not done yet — so you can judge for yourself rather than take a badge on trust.
Your data stays in India
Both halves of the service run in Mumbai: the database that holds your leads, units and cost sheets is in the AWS Mumbai region (ap-south-1) through Supabase, and the application runs from Vercel's Mumbai region (bom1). Nothing is replicated outside India.
It is also why the app feels quick here — a lead you save travels a few milliseconds, not halfway around the world.
Your workspace has its own Postgres database in Mumbai. Nothing of yours shares a table with another company's records.
Row-level security decides every read and write. Hiding a button is not security; refusing the query is.
HTTPS everywhere with HSTS, and the managed database encrypts what it stores on disk.
Sign-in runs through Supabase Auth, which keeps a one-way hash. Nobody — including us — can read an existing password.
Every lead, unit and cost sheet leaves as CSV from inside the app, with no request to us and no exit fee.
The managed database takes automated daily backups with point-in-time recovery on the hosting plan we run.
Who can see what
| Role | Leads | People & settings |
|---|---|---|
| Owner / admin | Every lead in the workspace | Create logins, set roles and passwords |
| Manager | Their own plus their team's | Sees their team; cannot create logins |
| Rep | Only leads assigned to them | No access |
| Viewer | Read-only, their own | No access |
Who else touches your data
We don't run our own servers. These companies host parts of the service, and each publishes its own security documentation:
- Supabase — the database, authentication and file storage behind your workspace. Hosted in AWS Mumbai (ap-south-1).
- Vercel — runs the application at app.gudvins.in, from their Mumbai region (bom1).
- Cloudflare — serves this marketing website and our DNS. No customer data passes through it; this site is static files.
- Google — only if you connect a Google Sheet or sign in with Google. We ask for the narrowest access that works and you can disconnect it any time.
We do not sell your data, share it with advertisers, or use it to train anything.
India's DPDP Act
Under the Digital Personal Data Protection Act, you are the data fiduciary for the buyers in your CRM and we are a data processor acting on your instructions. In practice that means we process what you put in, keep it inside your workspace, delete it when you tell us to, and help you answer a buyer who asks what you hold about them. Ask us for a written data processing agreement and we'll send one.
What we haven't done yet
No ISO 27001 or SOC 2 certification, and no independent penetration test. We're early, and we won't buy a badge before we've earned it. The infrastructure underneath — Supabase, Vercel, AWS Mumbai — holds its own certifications; our application code has not been audited by a third party.
No two-factor login yet. It's on the roadmap. Today, logins are created and controlled by your admin, a password can be changed in seconds from the Employees screen, and deactivating someone cuts their access immediately.
No customer-downloadable audit file yet. Every change to a lead — who changed what, and when — is already recorded and visible in that lead's History tab. What's missing is a way to export the whole log.
If any of these decide the purchase for you, say so. We'd rather tell you where we are than lose your trust later.
Found a problem?
Write to hello@gudvins.in with "security" in the subject. We'll reply within two working days, keep you posted while we fix it, and credit you if you'd like.
Questions
- Can another company using Gudvins see my leads?
- No. Every record carries its workspace, and the database enforces that on every read and write with row-level security — not just the screens. A query that doesn't belong to your workspace returns nothing.
- Where is my data stored?
- In Mumbai. The database sits in the AWS Mumbai region (ap-south-1) through Supabase, and the app runs from Vercel's Mumbai region. Nothing is replicated outside India.
- Can your team read my leads?
- Technically, an administrator with production access could, as at any hosted software company. We don't do it except when you ask us to look at a specific problem, and we don't sell, share or train anything on your data.
- Is my data mine, and can I take it out?
- Yes. Export every lead, unit and cost sheet to CSV from inside the app, on any day, without asking us. See Terms.
- What happens if there is a breach?
- We tell affected customers within 72 hours of becoming aware, with what we know, what we're doing and what you should do. We'd rather send an awkward email early than a tidy one late.
- Are you ISO 27001 or SOC 2 certified?
- No. We're an early-stage product and we won't claim a certification we don't hold. The infrastructure we build on (Supabase, Vercel, Cloudflare) holds its own certifications; the application has not been independently audited yet.
- Who can do what inside my workspace?
- Owners and admins see everything and manage logins. A manager sees their own leads plus their team's. A rep sees only the leads assigned to them. Those limits are enforced in the database, so they hold even if someone edits a URL.
Start free today. Pick a plan when early access ends.
No setup fee. No sales call.
Last updated 20 October 2026. Something out of date? Tell us.