Security at DealJourney
You are about to put your customer list, your pipeline and your invoicing inside someone else's software. This page is a plain account of how we protect it, who else touches it, and what we have not done yet.
Last reviewed August 2026
Where your data lives
- Frontend
- React and TypeScript, served over HTTPS only.
- API
- Python and FastAPI, running as stateless application servers.
- Database
- Supabase, a managed PostgreSQL service on AWS, encrypted at rest with automated backups.
- Hosting
- Railway, in Docker containers, deployed through GitHub Actions.
- Authentication
- Supabase Auth, issuing short-lived JWT sessions signed with asymmetric keys (ES256 or RS256).
Which region your data sits in matters to some buyers, and the honest answer is that it depends on the account. Ask us and we will confirm the current region for yours in writing before you sign anything.
How your data is protected
- 01
One tenant cannot see another
Every database query is scoped to the tenant on your verified login token, never to a value the browser could change. PostgreSQL row-level security sits underneath as a second, database-level barrier, so an application bug on its own is not enough to cross the line.
- 02
Encrypted in transit and at rest
TLS from the browser to the API, and from the API to the database. The database and its backups are encrypted at rest by the managed platform.
- 03
Every request re-checks your session
Signature, expiry and audience are verified on each API call against Supabase's published keys, and the algorithm is pinned so a token cannot be swapped for an unsigned one. Sessions are short-lived and refresh automatically, which makes a stolen token worth very little.
- 04
Roles that actually gate things
Regular users, tenant admins and DealJourney platform staff are separate tiers. Cross-tenant and platform operations are authorised from the verified token identity, never from something supplied in the request body.
- 05
Secrets stay server-side
API keys, OAuth tokens and database credentials live in server configuration and the database. They are never written to browser storage, source control or logs. A connected mailbox leaves only a flag in the frontend saying which account is linked.
- 06
A record of who changed what
Key actions are written to an audit log, so an incident or a dispute can be reconstructed instead of argued about.
What we do about it continuously
We audit every route, not a sample
Tenant scoping is treated as a per-query invariant and checked exhaustively across the codebase. The most recent full sweep covered roughly 133 write modules and 53 public routes, and the fixes are held in place by regression tests.
Nothing ships without passing the gates
Type checking, linting and roughly 3,400 automated tests, including dedicated authentication, security and money-handling suites, run on every change before it can reach production.
Errors cannot be silently swallowed
Backend and frontend errors funnel into one log, and quietly discarding an error is blocked automatically before it can be committed.
What we have not done yet
We do not hold ISO 27001 or SOC 2 certification. We would rather write that here than let you discover it in the third meeting. If your procurement process requires a certified vendor today, we are not the right fit yet.
What we can do instead: walk your security team through the architecture, complete your security questionnaire, sign a data processing agreement, and put specific answers in writing. If that is enough for your process, we are straightforward to work with.
Your data and the paperwork
- Data processing agreement
- We will sign a DPA. Ask and we will send you the current version.
- Deleting your data
- Ask us to delete your account and your data goes within 30 days, apart from anything we are legally required to keep.
- Getting your data out
- Your records export from the product as CSV, and the public REST API can read everything your API key is scoped to. Leaving does not require our cooperation.
- Sub-processors
- Supabase for database and authentication, Railway for hosting, and Resend for transactional email. AI assistant features send the relevant prompt to a model provider. ERP and mailbox connectors only carry data once you connect them yourself.
- GDPR
- We are a Danish company and operate under GDPR. The rights described in our privacy policy are the ones you actually have.
The full detail on what we collect and why lives in the privacy policy.
Reporting a vulnerability
If you think you have found a security problem, please tell us before you tell the internet. Send us what you did and what you saw, and give us a reasonable window to fix it. We will confirm we received it, keep you posted while we work on it, and credit you publicly if you want the credit.
support@dealjourneycrm.comStill have questions?
Security questionnaires, architecture walkthroughs and DPA requests all go to the same place. A real person answers, and if we do not know something we will say so rather than guess.
Talk to us