Security & Compliance

CRMBridge Trust Center

Trust is built through transparency. Security and privacy are embedded into every stage of the CRMBridge platform — defense-in-depth, least-privilege access, strong identity controls, continuous monitoring, and secure-by-design development.

Contact Security Privacy Policy

Security & privacy by design

CRMBridge.ai is purpose-built for healthcare data, with technical, administrative, and organizational safeguards aligned to HIPAA, GDPR, and CCPA/CPRA — running on SOC 2 / ISO 27001-attested AWS infrastructure.

Encryption in transit and at rest, with PHI-aware data handling

Least-privilege access, MFA, and audit logging

Continuous monitoring & documented incident response

AES-256

At rest

TLS 1.2+

In transit

99.99%

Uptime target

BAA

On request

HIPAA

PHI safeguards, audit logging, BAA available.

View details →

AWS-backed infrastructure

Runs on AWS, which maintains SOC 1/2/3, ISO 27001, and PCI DSS L1. CRMBridge inherits these infrastructure controls.

AWS-attested

Live rating

SecurityScorecard

Continuously monitored, based on externally observable signals.

GDPR

Data subject rights & DPA available.

CCPA / CPRA

California privacy rights honored.

Canadian privacy

PIPEDA & Ontario PHIPA

For Canadian dental practices, CRMBridge acts as a service provider (agent) to your practice — the health information custodian — processing personal health information on your behalf and under your instructions, in support of your obligations under Canada’s PIPEDA and Ontario’s PHIPA. A data-processing agreement is available, and cross-border processing is disclosed in the Subprocessors section below.

Service provider / agent DPA available Cross-border disclosed

Controls

The technical, administrative, and organizational safeguards operating across the CRMBridge platform.

Product security

Role-based access control (RBAC)
MFA for administrative & partner accounts
AES-256 encryption at rest; TLS 1.2+ in transit
Payload-level encryption for sensitive integration traffic
Secure API key issuance, rotation, and revocation

Infrastructure security

Hosted on AWS (SOC 1/2/3, ISO 27001, PCI DSS L1)
Cloudflare web application firewall & DDoS protection
API rate limiting and abuse throttling
Endpoint detection & response with continuous monitoring (Bitdefender GravityZone)
Network segmentation and least-privilege security groups
Encrypted, tamper-proof backups in Amazon S3 with disaster recovery

Access control

Least-privilege access to production systems
MFA enforced for administrative and remote access
Access reviews and prompt deprovisioning on offboarding
Audit logging of data access and privileged actions

Organizational security

Security awareness training for all personnel
Employee background checks where permitted by law
Confidentiality agreements acknowledged by staff
Documented incident response and breach notification

Privacy & legal

Business Associate Agreement (BAA) available
Data Processing Agreement (DPA) available
Canadian privacy support (PIPEDA & Ontario PHIPA) as service provider/agent
Cross-border transfer transparency and accountability
Data retention and secure deletion procedures
Customer data returned or destroyed on termination

Artificial intelligence

AI acceptable-use and data-handling policy
PHI minimization before any model processing
No customer PHI used to train third-party models
Subprocessor terms govern all LLM providers

Subprocessors

The third-party services CRMBridge uses to deliver the platform. Each is bound by data protection terms and, where PHI is involved, a Business Associate Agreement.

Amazon Web Services (AWS)

Cloud provider

Compute, storage, database, and networking that host the CRMBridge platform and customer data.

Global

Cloudflare

Edge network, WAF & DDoS

Content delivery, web application firewall, DDoS protection, and TLS termination for inbound traffic to the CRMBridge platform.

OpenAI

AI / ML services

Natural-language query processing for CRMBridge AI features.

No PMS data — NLP queries only

Anthropic

AI / ML services

Natural-language query processing for CRMBridge AI features and the website support assistant.

No PMS data — chat messages and NLP queries only

We provide at least 30 days' prior written notice before adding or replacing a subprocessor, and customers may object on reasonable grounds. To receive change notifications, email [email protected].

The subprocessors above process data in the United States (or globally, for edge services). For customers subject to Canadian privacy law (PIPEDA / Ontario PHIPA), CRMBridge remains accountable for this cross-border processing and applies contractual and technical safeguards; your practice, as the health information custodian, remains responsible for any required patient consent and notice.

Resources

Reference reports, policies, and procedure documents. Items marked with a lock are available on request (some under NDA).

Security grades

Attestations & testing

Policies & procedures

Frequently asked questions

How does CRMBridge protect PHI?

PHI is encrypted at rest with AES-256 and in transit with TLS 1.2+, access is governed by role-based controls and least privilege, and all access to sensitive data is audit-logged. Sensitive integration traffic is additionally protected with payload-level encryption. See our HIPAA Compliance page for detail.

Do you sign a Business Associate Agreement (BAA)?

Yes. CRMBridge enters into a BAA with covered entities and business associates that use the platform. Email [email protected] to request one as part of onboarding.

Do you enforce multi-factor authentication (MFA)?

Yes. MFA is enforced for administrative and partner accounts, and all access is governed by role-based access control (RBAC) so each user is scoped to only what they need.

Do you support Canadian privacy laws (PIPEDA and Ontario PHIPA)?

Yes. For Canadian dental practices, CRMBridge acts as a service provider (agent) to your practice — the health information custodian — processing personal health information on your behalf and under your instructions, in support of your obligations under Canada's PIPEDA and Ontario's PHIPA. A data-processing agreement is available (the Canadian counterpart to our BAA). Data is processed on AWS infrastructure located in the United States; CRMBridge remains accountable for this cross-border processing and applies the same encryption, access-control, and audit safeguards described above, while your practice remains responsible for obtaining any required patient consent and notice. Our breach-notification process aligns with the Office of the Privacy Commissioner of Canada and Ontario's Information and Privacy Commissioner (IPC). Email [email protected] to request the data-processing agreement.

Where can I find your subprocessors and DPA?

Our current subprocessors are listed in the Subprocessors section above. A Data Processing Addendum is available on request from [email protected].

How do I report a security vulnerability?

Please email [email protected] with details and steps to reproduce. We investigate all reports and will acknowledge receipt.

What security documentation can you share?

On request (some under NDA): a HIPAA Security Rule assessment mapped to NIST SP 800-66 Rev 2, our penetration test executive summary, platform architecture and network diagram, and a Data Processing Addendum (DPA). AWS's SOC 2 / ISO 27001 reports for the underlying infrastructure are available directly from AWS Artifact. Request documents from the Resources section above.

Have a security question?

Our security team is here to help you understand how CRMBridge protects your data — and to provide reports, questionnaires, or a BAA for your review.

Contact Security Team General Contact

This page summarizes our security and compliance posture. To report a vulnerability or request documents, contact [email protected].