Security and data residency
What follows is what we actually do today. Where a control is not in place, this page says so rather than implying otherwise.
Where your data lives
Hosted in Singapore
Both the application and its database run on a single instance in AWS's Singapore
region, ap-southeast-1, with storage attached in the same availability
zone. Nothing is replicated to another region.
Your data stays in Singapore.
How your data is kept apart from other customers'
Row-level tenant isolation
Every table carries a tenant identifier as part of its primary key, and PostgreSQL row-level security is enforced on all of them. The database role the application uses for ordinary requests cannot read across tenants even if a query tried to — the policy is applied by the database, not by the application code, so a bug in a query cannot leak another customer's rows.
Certification
ISO 27001 certified — the same information security management system JustLogin has run for years covers this CRM.
That matters more than anything we could write on this page. It means an external auditor has examined how access is controlled, how changes are managed and how incidents are handled — not just that we say we do those things. Ask us for the certificate and its scope statement; we would rather you checked.
Access and sessions
Sessions are held in an HttpOnly cookie with a 24-hour lifetime. Passwords are hashed, never stored or logged in the clear. Service-to-service calls use a per-tenant API key rather than a user session. Roles scope what each person can see — a sales rep does not see another rep's pipeline unless an account is explicitly shared with them.
What we do not offer today
Being specific here is more useful than a list of reassuring words:
- No SAML or single sign-on. Sign-in is email and password, or Google.
- No single-click export of an entire tenant. You can export any list view to CSV at any time, but a full-tenant dump is a request we handle by hand.
- No customer-managed encryption keys.
If one of those is a requirement for you, say so before you start rather than after — crm@justlogin.com.
This website
These pages are static files. They set no cookies, load nothing from a third party, and run no analytics or tracking script. The only thing the site does with an email address you type is pass it to the signup page on this same host.