Commission data is salary data, so we treat it with care. This page describes how we protect it and how to report a vulnerability.
How we protect your data
- Encryption in transit. The website, the app and its API are served only over HTTPS (TLS), with HTTP Strict Transport Security.
- Encryption at rest. Data is stored with our cloud providers, encrypted at rest.
- Tenant isolation. Each company's data is separated in the database with row-level security, so one customer can never read another's data.
- Role-based access. Reps see their own numbers. Managers and admins see their team. Database functions that change payroll data cannot be called by anonymous or unauthorized users.
- Least data. From your CRM we sync only deals and the users who own them. We don't store contacts, organizations, notes, emails, activities or files.
- Credential handling. CRM OAuth tokens and API keys stay on our servers, are used only by our server functions, and are deleted when you disconnect.
- Website hardening. A Content Security Policy, frame protection, a strict referrer policy, and no third-party trackers or cookies.
- Infrastructure. We run on managed cloud platforms with automated backups. Our sub-processors are listed in the Privacy Policy.
Customers who need more detail for a vendor review can email info@deltadrive.app. Our Data Processing Agreement includes our technical and organizational measures and breach notification commitments.
Reporting a vulnerability
If you believe you have found a security vulnerability in deltadrive.app or my.deltadrive.app, please email info@deltadrive.app with "Security" in the subject line. Include:
- a description of the issue and its potential impact;
- the steps or a proof of concept to reproduce it;
- the affected URL or component.
We will acknowledge your report within 5 business days, keep you updated, and tell you when it is fixed.
Please
- Test only against accounts you own or have permission to use.
- Don't access, change or delete other people's data. If you reach data that isn't yours, stop and tell us.
- Don't run denial-of-service tests, spam, social engineering or physical attacks.
- Give us reasonable time to fix the issue before disclosing it publicly.
If you follow these rules in good faith, we will not take legal action against you for your research, and we will credit you if you wish. We don't run a paid bug bounty at this time.
Our machine-readable contact details are at /.well-known/security.txt.