Security and data protection
Protecting the customer data your team works with every day.
Strong account authentication, workspace-scoped access, established cloud infrastructure and data-control tools — included for every Kustmr workspace.
Security controls are included for every licensed user.
Security at a glance.
Core protections built into the product — not reserved for a higher plan.
- Strong account authentication
- Workspace-scoped access
- Owner, admin & member roles
- Regular backups
- Data export & deletion
- Controlled infrastructure access
Account security
Account access requires two steps.
Kustmr uses email and password together with a time-limited verification code sent to the account email. You can optionally remember a browser for 30 days after a successful code verification; password authentication is still always required.
Two-factor login verification remains mandatory on untrusted devices — not an optional add-on you can turn off.
- Password + email-code login
- Optional Google sign-in
- Optional Microsoft sign-in
- Time-limited challenges
- Account setup flow
- Password reset flow
- Removed users blocked
Workspace access
Customer data stays in the correct workspace.
Authenticated requests are scoped to the user's workspace so customer, sales and project information loads within the correct business context.
Owner, admin and member roles control selected administrative actions. Removed team members are blocked from authenticating.
- Workspace-scoped requests
- Role-based admin actions
- Licensed access controls
- Team managed by owners
Data control
Keep control of your business data.
Export supported core business records when you need a copy outside Kustmr.
Permanently delete supported records from the workspace when information should no longer be retained.
- Export companies & contacts
- Export deals & projects
- Delete supported records
- Permanent removal from workspace
Infrastructure
Established services, operated with controlled access.
Kustmr uses established cloud infrastructure for web delivery, application services, database and storage. Production systems are managed through controlled administrative access. Regular backups support operating and maintaining the service.
- Vercel
- Public web delivery and hosting.
- Render
- Application services and scheduled jobs.
- Supabase
- Database and selected storage.
Clear security claims instead of vague promises.
Kustmr only publishes security claims supported by current product and operating practices. Certifications, storage regions, encryption standards and uptime guarantees are not published until formally verified.
Start with strong account protection and the complete Kustmr product.
Use every feature free for 14 days. No credit card required.
FAQ
Security questions
Clear answers about account access, workspace separation, infrastructure, backups and data control.
Is two-factor authentication required?
Password login requires Kustmr email-code verification after you enter your password, unless this browser was previously marked as a trusted device for up to 30 days. If you sign in with Google or Microsoft after connecting it to your Kustmr account, that provider is the federated identity provider for that sign-in — Kustmr never receives your Google or Microsoft password. Kustmr does not claim that every Google or Microsoft account has provider-side multi-factor authentication enabled.
Can I remember a device so I do not enter a code every time?
Yes, for password login. After a successful email verification code, you can choose Remember this device for 30 days. On that browser, correct email and password can skip the code challenge for up to 30 days. Untrusted browsers still require the code. Trusted devices apply only to password + email-code login — not to Google or Microsoft sign-in. Trusted devices are revoked when you reset or change your password, or when you are removed from the workspace.
Does Kustmr support authenticator apps or security keys?
Not currently. Kustmr currently uses a time-limited verification code sent to the user’s account email for password login, and optional Google or Microsoft sign-in for federated authentication.
Can I sign in with Google?
Yes, when Google sign-in is enabled for your environment. You can create a workspace with Google, sign in with a linked Google account, or connect Google from Profile. Google sign-in only receives limited identity information (Google account identifier, name, email and email-verification status). Connecting a Gmail mailbox in Settings is a separate, optional step and is not part of Google sign-in.
Can I sign in with Microsoft?
Yes, when Microsoft sign-in is enabled for your environment. You can create a workspace with Microsoft, sign in with a linked Microsoft account, or connect Microsoft from Profile. Kustmr only receives limited identity information (Microsoft account identifier, name and email). Microsoft sign-in is for account access only — it does not connect your Outlook mailbox and does not request access to Outlook email, calendar, contacts or files.
Which infrastructure providers does Kustmr use?
Kustmr currently uses Vercel for web delivery, Render for application services and Supabase for database and selected storage infrastructure.
Is customer data separated by workspace?
Yes. Authenticated application requests are scoped to the user’s workspace so business data is loaded within the correct workspace context.
Does every user have the same permissions?
No. Kustmr uses owner, admin and member roles to control selected administrative actions. Kustmr does not currently offer a fully customizable enterprise permission system.
What happens when a team member is removed?
A removed team member is blocked from authenticating to the workspace.
Can we export our data?
Yes. Kustmr supports export of companies, contacts, deals and projects when needed.
Can we permanently delete information?
Yes. Supported companies, contacts, deals, projects, tasks and time entries can be permanently deleted from the workspace.
Does Kustmr use backups?
Yes. Regular backups are part of operating the service. Kustmr does not publish a specific backup frequency or retention period until those details are formally documented.
Is Kustmr SOC 2 or ISO certified?
Kustmr does not currently claim SOC 2 or ISO certification.
Does Kustmr publish a data-storage region or uptime guarantee?
Not currently. Kustmr does not publish a specific storage-region or uptime claim until the current configuration and supporting documentation are formally verified.
How can we ask a security or data-protection question?
Email support@kustmr.com with your question. The Kustmr team will respond in writing based on the product and operating practices currently in place.
Still have questions? Contact us at support@kustmr.com.