Draft — pending legal review

Security

Last updated: October 2026

How Remedy Circuit works

Remedy Circuit is a hosted CRM service. When your business signs up, you get a private workspace for your contacts, pipeline, bookings, quotes and invoices, conversations, and AI agents. Many businesses use the same underlying platform, but each workspace is logically isolated: your team can see your workspace’s data, and no other customer can. This page explains, in specific terms, how that protection works — and the parts that depend on you.

We do not currently hold third-party security certifications (such as SOC 2 or ISO 27001), and the Service is not designed for storing data regulated under HIPAA or PCI DSS. Please don’t store health records or payment card numbers in your workspace.

1. Managed infrastructure

• Hosting: the application runs on Vercel’s managed platform, which maintains the operating system, network, and runtime. All traffic is served over HTTPS.
• Data and sign-in: data is stored in Google Cloud Firestore, and sign-in is handled by Firebase Authentication. The database has no open connection string; it is reachable only through authenticated, rule-checked requests or our own server. Google encrypts stored data at rest.
• Payments: subscriptions and card payments are processed by Stripe. Card numbers are entered on Stripe’s pages and are never stored in Remedy Circuit.

2. Workspace isolation

Every record — contacts, deals, tasks, events, forms, conversations — is tagged with the workspace it belongs to. Isolation is enforced at more than one layer:

1. Database security rules deny access by default and allow a read or write only when the signed-in user is an active member of the record’s workspace.
2. Server-side permission checks on our API endpoints re-verify the caller’s identity, role, and workspace membership from their authenticated session rather than trusting the browser.
3. Record-level checks confirm that a referenced record (for example, the contact on a deal) belongs to the same workspace before acting on it.

3. Accounts, roles, and access

• Sign-in uses Firebase Authentication with secure, signed session cookies. We never see or store your password in plain text.
• There is no open registration. New users join by invitation to a specific workspace and role.
• Roles are enforced: workspace administrators manage members and settings; collaborators work with data but can’t manage members.
• Removing a member revokes their workspace access, and if they have no other access their sign-in is disabled.
• Some features (for example bulk email, outbound AI calling, and API access) are turned off by default and are enabled per workspace only when you need them.

4. Secrets and API keys

• Platform service credentials are stored in server-side environment configuration, not in source code or in the browser.
• Workspace API keys are stored only as one-way hashes. The full key is shown once, at creation. Each key is scoped to a single workspace and can be revoked at any time.
• API keys are masked in server logs.

5. Public links

Some pages are public by design — a quote or invoice sent to your customer, a booking reschedule link, an unsubscribe link, or a payment link. These links carry cryptographically signed (HMAC) tokens that can’t be guessed or forged. Where a link can be re-sent, only a hash of the current token is stored, and re-sending invalidates older copies.

6. Verified webhooks

Inbound events from our providers — payments, text messages, calls, email, and scheduled jobs — are checked against the provider’s signature or a shared secret before they are processed, and requests that fail verification are rejected. Webhooks we send to your own integrations are signed, so your systems can verify that an event genuinely came from Remedy Circuit.

7. AI with guardrails

• The in-app AI assistant can only use a fixed list of capabilities. It has no general access to the database, and each capability is limited to the workspace you are working in.
• When the assistant proposes a change to your data, you confirm it before it runs. Assistant actions are recorded in an audit log.
• AI conversation agents (web chat, text, and phone) reply to your contacts automatically when you turn them on. You control which channels are active, and you can switch a conversation to suggest-only or take it over yourself at any time.
• To generate replies, the relevant conversation content is sent to our AI providers. See our Privacy Policy for the list of service providers.

8. Your data, your control

We don’t sell your data or your contacts’ data. You can export your contacts and remove records from your workspace, and you can ask us to delete your account data as described in our Privacy Policy.

9. What’s on you

Security is shared. Please:

• Use a strong, unique password for Remedy Circuit, and protect the email account you sign in with (enable two-factor authentication on it).
• Only invite people who need access, give them the lowest role that works, and remove people promptly when they leave.
• Treat API keys and webhook secrets like passwords — never share them in chat, screenshots, or public code.
• Collect proper consent before messaging or calling your contacts, and don’t store sensitive data such as health records, government ID numbers, or card numbers in your workspace.

10. Reporting a security concern

If you believe you’ve found a vulnerability or suspect unauthorized access to your workspace, please email founder@remedycircuit.com privately rather than posting publicly, so it can be investigated and fixed first. Good-faith reports are welcome.