Your customers’ data, and what we do to keep it.
Custral runs your email, messaging, calls, and customer records, so protecting that data is foundational. Here’s how we keep it safe, and where to find the details.
Encryption everywhere
Your data is encrypted in transit with TLS and at rest.
Granular access control
Permissions down to the object, record, and property, granted to a person or a team, with least-privilege access and multi-factor authentication for our team.
Activity logging
Record and field changes, tasks, conversations and workflow runs are recorded and attributable, on a rolling 90-day window.
Compliance
A SOC 2 Type II examination is in progress with an independent auditor, and the platform is built to support GDPR and CCPA.
Infrastructure
Hosted on Amazon Web Services in the United States, with continuous monitoring and regular backups.
Guest access
External guests and shared links see only the records you choose to share, nothing more.
Caller verification
Support calls prove both sides: your agent reads out two words from us, the caller reads back a six-digit code, and until they do, their contact details cannot be changed and their record cannot be shared or deleted.
Data privacy
We handle the data you run through Custral as a processor, under a Data Processing Addendum, and we never sell it.
Incident response
We monitor for security issues and will notify affected customers of a data breach as the law requires.
SOC 2 Type II, in progress
Our controls are monitored continuously by Oneleet while the examination runs with an independent auditor. The badge above reports our live status rather than a snapshot. The report is shared under NDA once it is complete.
Open the trust centerRead the details
A Data Processing Addendum (DPA) is available to customers on request. Email privacy@custral.com.
Report a vulnerability
Found a security issue? We appreciate responsible disclosure. Report it through the form in our trust center with the details and steps to reproduce, and we’ll respond promptly. Please give us a reasonable chance to address the issue before disclosing it publicly.