Security.
The controls in place today, each verified against the system: how each organization's data is kept apart, who can see what, how data is encrypted, and what our own team can reach.
Customer data isolation
One organization per person
Every person belongs to one organization, taken from their sign-in and never from anything the browser sends.
Organization on every business table
Every table holding business data carries the organization it belongs to, and a check fails the build if a new one does not.
Tested with two organizations
A permanent test creates two organizations and checks that sales-team pages never show one organization's deals, bookings or accounts to the other.
Attacked from a second organization
An adversarial pass from a second organization found one defect, sales reads narrowed by salesperson without the organization; it was fixed at the cause and the two-organization test covers it.
Access control
Password sign-in, hashed with Argon2id
People sign in with an email address and password. Passwords are stored only as Argon2id hashes.
Expiring, single-use links
Password reset links work once and expire after an hour, and never reveal whether an account exists. Invitations expire after seven days.
Roles and permissions
Five roles (Admin, Manager, Setter, Closer, CSM), adjustable by your admins per role and per person, and checked on the server on every request.
Each salesperson's own pipeline
Setters and closers see the deals assigned to them or their team unless given full visibility, applied in the database query.
Settings changes are logged
Changes to members, roles, teams, billing, integrations and pipeline settings are logged with who made them and what changed, and your admins can read the log.
Encryption
In transit
Signet is served over HTTPS, reaches its database over encrypted connections, and calls every provider over HTTPS.
At rest
Data is stored in a Neon Postgres database in AWS us-east-1, encrypted at rest by Neon. Call recordings and transcripts are kept in private storage.
Connection credentials
Credentials for the accounts you connect are encrypted with AES-256-GCM under a key made for that connection, wrapped by a versioned key held outside the database, and deleted when you disconnect.
Our access
No impersonation
Signet has no feature that lets anyone at Signet sign in as you or switch into your organization.
Engineering database access
Our engineers can reach the production database with operator tools, and those reads are not recorded in the product.
Report a security concern.
Not yet settled: Security contact
A Signet address for reporting security concerns exists and is monitored, published with a security.txt. Today there is none.