1. Scope
This Security Overview summarizes Vestrum's current security controls for Vestrum CRM. It is descriptive and does not create an additional warranty or security certification.
2. Encryption
- Encryption in transit is used for supported communications and connections.
- Encryption at rest is used for stored data within supported infrastructure.
3. Authentication
- Multi-factor authentication (MFA) is available.
- Single sign-on (SSO) is not currently offered.
- Customers are responsible for appropriate user provisioning, password security, and access management.
4. Infrastructure
Vestrum uses Cloudflare services for infrastructure/network/security functions and Telnyx for telecommunications connectivity. Production infrastructure is currently hosted in the United States. Third-party infrastructure is subject to provider security controls and contractual terms.
5. Access Control
Vestrum limits access to systems and data according to operational need and maintains administrative controls appropriate to the Service.
6. Monitoring and Incident Response
Vestrum maintains reasonable measures to detect, investigate, and respond to security events and may suspend affected accounts or integrations where necessary to protect the platform. Vestrum targets notifying affected customers without undue delay, and in any case no later than seventy-two (72) hours after confirming a security incident involving Customer Data, consistent with the Data Processing Addendum.
7. Customer Responsibilities
- Use MFA where available.
- Maintain unique credentials.
- Limit administrative privileges.
- Protect API keys and webhooks.
- Report suspected compromise promptly to owners@vestrumllc.com.
8. Limitations
Vestrum does not currently represent that it maintains SOC 2, ISO 27001, HIPAA, PCI DSS, or other specific certification unless separately stated in writing. Vestrum does not currently perform third-party penetration testing on a fixed schedule; this Section will be updated if that changes.