Data Security & Compliance Statement
For a plain-language overview of these same practices, see our Security & Trust page.
1. Infrastructure
Invictus CRM is built on Google Cloud Platform / Firebase infrastructure, which maintains ISO 27001, SOC 2, and SOC 3 certifications at the infrastructure level. Data is encrypted in transit (TLS) and at rest.
2. Data Isolation
Each agency's data is logically isolated from every other agency on the platform through per-agency access-control rules enforced at the database level, not merely at the application layer. An advisor can only access data belonging to their own agency and, within that, only the clients/leads they own or are permitted to see.
3. Access Controls
- Every account requires email verification before any data access is granted.
- New agencies are manually reviewed and approved by the platform administrator before gaining access, to prevent unverified or fraudulent signups.
- Two-factor authentication (TOTP) is available and recommended for all accounts.
- Agency owners can pause or remove team members' access at any time.
4. Backups and Availability
Data is backed up using point-in-time recovery capabilities provided by our infrastructure provider. Uptime is monitored continuously, with automated alerting for any detected downtime.
5. Audit Trail
Every electronic signature completed within Invictus CRM is logged with a timestamp, the signer's IP address, and a unique certificate ID, creating a verifiable audit trail for compliance purposes. See our Electronic Signature & Records Consent statement for details.
6. Sub-Processors
We use a limited number of trusted third-party sub-processors to operate the platform, including:
| Provider | Purpose |
|---|---|
| Google Firebase / Google Cloud | Application hosting, database, file storage, authentication |
| Resend | Transactional email delivery |
| Stripe | Subscription billing and payment processing |
Each sub-processor only receives the minimum data necessary to perform its specific function.
7. Breach Notification
In the event of a confirmed data breach affecting your personal information, we will notify affected agencies without undue delay, consistent with our obligations under PIPEDA and applicable provincial privacy legislation.
8. Contact
Security questions or concerns can be sent to support@invictuscrm.com.