Security built into every layer.
From role-based permissions to two-factor authentication, SSO, separation of organisation data and GDPR tools – an overview of what EasyCRM does to protect your data.
Role-based permissions
EasyCRM uses Spatie RBAC with roles kept separate for each organisation. Each role has defined permissions for modules such as contacts, leads, opportunities, inbox, telephony, reports, billing and privacy. The organisation admin edits role permissions directly in settings. Permissions are checked on the server, not only in the user interface.
- Permissions per module (contacts, leads, opportunities, inbox, telephony, reports, billing)
- Default roles: Owner, Admin, Management, Sales, Support, Accounting
- The admin edits role permissions in settings
- Permissions are checked on the server
Two-factor authentication and enterprise SSO
EasyCRM supports TOTP (time-based one-time passwords) via an authenticator app. Each user turns on two-factor authentication themselves and receives recovery codes in case a device is lost. For teams with an existing identity provider, the Pro plan offers SSO via SAML 2.0 (SP-initiated, ACS callback, metadata endpoint, JIT provisioning) or OpenID Connect with PKCE and nonce and JWKS signature verification.
- Two-factor authentication via authenticator app (TOTP)
- Recovery codes for regaining access
- SSO via SAML 2.0 (Pro) – JIT provisioning
- SSO via OpenID Connect + PKCE (Pro)
GDPR and separation of organisation data
Organisations share a database, but every query is automatically scoped to `organization_id`, so one organisation cannot see another's data. Each organisation works on its own subdomain. EasyCRM includes GDPR tools: for each data subject you record consent and its withdrawal with a full history, export a JSON file with that person's consent records and audit records, or anonymise personal data on request. The audit log records changes to contacts, leads, opportunities, activities, quotations, orders, products, conversations, messages and call logs. ULID identifiers ensure numeric IDs do not appear in URLs or the API. Incoming Meta webhooks and e-mail webhooks are verified by signature before processing.
- Shared database, every query scoped to the organisation (`organization_id`)
- GDPR: consent history, JSON export of consents and audit records, anonymisation of personal data
- Audit log of changes to the main CRM records
- ULID identifiers – no numeric IDs in URLs or API
- Signature verification of incoming webhooks (Meta, e-mail)
An overview of what EasyCRM protects
- Team member access follows the assigned role
- 2FA protects accounts even without an enterprise identity provider
- SSO connects EasyCRM to your corporate identity (Pro)
- Queries are scoped to your organisation's data
- GDPR tools: consents, export, anonymisation
- A data subject's consent is recorded with a change history
- Audit log of changes to the main CRM records
Questions about EasyCRM security
Set the right access for your team from day one
Register for free and set up roles, 2FA and GDPR tools.