Workspace isolation,by default.
Crimson treats every workspace as a hard boundary enforced in the database itself — not as a filter applied later in application code.
Row-level isolation
Every record carries its workspace, and the database refuses to return data across workspaces. Access is granted through explicit capabilities rather than role-name checks.
Encrypted credentials
Mailbox OAuth tokens are encrypted at rest with AES-256-GCM, with keys held separately in secured environment secrets. Messaging and telephony credentials are scoped to the workspace that owns them.
Permissions that match the team
Each workspace role sees and does only what it allows. Sensitive actions — sending setup, phone numbers, billing — are gated by capability.
Encryption in transit
All traffic between your browser, Crimson, and connected providers travels over HTTPS/TLS.
Your data stays yours
Crimson does not sell personal information or use your Google data for advertising, and does not use it to train generalized AI models.
Disconnect any time
Disconnecting a mailbox immediately deletes its stored tokens and stops sending and syncing through it.
Questions about security?
Bring them to a demo, or email hello@gocrimson.io — we'll answer them directly.