Security · Coastline CRM

Security at Coastline

You are about to put your customer list, your pricing, and your signed contracts into software run by somebody else. That deserves a straight answer about how it is protected. This page is that answer, in plain language, describing controls that are in the product today.

Your data is isolated by the database itself

Most business software keeps one customer’s records away from another’s by adding a filter to every query. That works right up until a developer forgets one, and then one customer sees another customer’s data. Coastline does not rely on anyone remembering.

Every table in our database enforces row-level security, so a query can only ever return rows belonging to your workspace. This is enforced by the database engine, underneath our application code.
The rule is applied even to the database owner account, not just to ordinary connections.
A safeguard automatically locks down any new table the moment it is created. If an engineer adds a table and forgets to write an access rule, that table returns nothing to everyone rather than everything to anyone. Locked by default, opened deliberately.
The practical effect: a forgotten filter in our code is a bug that shows you too little of your own data. It cannot show you somebody else’s.

Encryption in transit and at rest

Your data is encrypted on the wire and on disk, and the credentials we hold on your behalf get a second layer.

All traffic is served over TLS. The application is delivered over HTTPS only.
Databases, file storage, and backups are encrypted at rest with AES-256 by our infrastructure providers.
When you connect an outside account (email, calendar, accounting), the access token we store for it is separately encrypted with AES-256-GCM before it is written down, using a key held outside the database. A copy of the database alone does not yield a usable token.
Third-party API credentials are held in a dedicated secrets vault rather than in ordinary application tables.

Access control that matches how your business actually works

Not everyone in a service business should see everything. Payroll, margins, and customer contact details rarely belong to the same people.

Over 110 individually-controlled permissions, grouped into roles you define. You are not stuck with a fixed set of three tiers.
Permissions are checked individually rather than by role name, so renaming a role or inventing a new one cannot accidentally widen access.
Two-factor authentication using any standard authenticator app, available to every member on every plan at no extra cost.
Workspace administrators can require two-factor authentication for everyone, and see who has not set it up yet.
Removing someone cuts off their access immediately, including any session they already had open.

A record of who did what

When something changes, you can find out who changed it and when.

Administrative changes (roles, permissions, member access, security settings) are written to an append-only audit log that the application cannot edit or delete after the fact.
Signed documents carry a tamper-evident audit trail: each recorded event is cryptographically chained to the one before it, so the sequence is verified whenever the record is read. An altered or removed event is detectable rather than silent.
Document access is logged separately, so you can see who opened or downloaded a signed agreement.

We never see your customers’ card numbers

Card data goes directly to our payment processor and never touches our servers.

Payments are processed by Stripe, a PCI DSS Level 1 service provider, the highest certification level defined by the card networks.
Card numbers, security codes, and bank account numbers are never stored in our database. There is no field for them.
Payment details are collected by the processor’s own hosted components, so the sensitive values do not pass through Coastline at any point.

Your data stays yours

No lock-in, no surprises about what we do with your records.

Your data is exportable while your account is active.
Account deletion runs on a 30-day grace period, so an accidental or malicious deletion is recoverable, then personal information is permanently anonymized.
We do not sell customer data, and we do not use the contents of your workspace to train AI models.
AI features process only the specific record you point them at, in the moment you ask, and the result is returned to you rather than retained for other purposes.

Infrastructure and subprocessors

Coastline runs on infrastructure operated by providers who hold SOC 2 Type II attestations. Below is every company that processes customer data on our behalf, what each one does, and what it can see. The second group is involved only if you turn on the feature that uses it.

Used for every workspace

Provider	Purpose	Data it can see
Supabase	Database, authentication, and file storage	All workspace records and uploaded files
Vercel	Application hosting and content delivery	Requests in transit; no persistent copy of workspace records
Amazon Web Services	Underlying cloud infrastructure for the services above	Encrypted storage and compute for the platforms built on it
Stripe	Subscription billing and customer payment processing	Billing contact details and payment instruments; card numbers are held by Stripe and never by Coastline
Resend	Delivery of automated email such as notifications and receipts	Recipient address and the contents of the message being sent
Anthropic	AI assistance features, reached through Vercel AI Gateway	Only the specific record or text you invoke an AI feature on; not used to train models
Sentry	Application error monitoring	Technical error diagnostics and an account identifier; not record contents

Used only when you enable the related feature

Provider	Purpose	Data it can see
Unipile	Connecting your email and calendar accounts (only if you connect one)	Messages and events in the mailbox or calendar you connect
Nylas	Calendar synchronization for existing connections	Events in the calendar you connect
Twilio	Text messaging and calling (only with messaging or voice enabled)	Phone numbers and message or call contents
xAI	AI voice agent (only with the voice add-on enabled)	Audio and transcripts of calls handled by the voice agent
Intuit QuickBooks	Accounting synchronization (only if you connect it)	Invoices, payments, and customer billing records you choose to sync
Google	Maps and address lookup, and calendar access if you connect a Google account	Addresses being looked up; calendar events if connected
Regrid	Property parcel data lookup	Property addresses being looked up
RoofScope	Measurement reports (only if you order one)	The property address the report is ordered for

Certifications, stated plainly

The infrastructure Coastline is built on is independently audited. Our cloud hosting, database platform, and payment processor all maintain SOC 2 Type II attestations, and our payment processor is certified PCI DSS Level 1.

Coastline itself does not yet hold its own SOC 2 attestation. We would rather say that directly than imply otherwise. A SOC 2 report is an auditor confirming a company follows its own written procedures; it is a meaningful signal of operational maturity, and it is also not the same thing as the technical controls described above, which you can ask us to walk you through in detail on a call.

If your organization requires a completed vendor security questionnaire, we have one ready to send today rather than in a few weeks.

Reporting a vulnerability

If you believe you have found a security issue in Coastline, email security@coastlinecrm.com. We acknowledge reports within two business days and will keep you updated until the issue is resolved.

We will not pursue legal action against researchers who report in good faith, give us a reasonable window to fix the issue before disclosing it, and avoid accessing or modifying data belonging to other customers while investigating.