Security
Security at Consilegy
How we protect the information you entrust to us, as of October 2026. Answers to the questions security reviews usually ask are available to download, no sign-up required.
Assurance
Policies and assessments
Information Security Policy
Our policy sets out management responsibility, organization, safeguards, customer information, training, compliance, incident response, and continual improvement.
SECURITY ACTION (two stars)
A self-declaration program run by IPA, Japan’s Information-technology Promotion Agency. Two stars means we have run IPA’s self-assessment and published an information security policy. It is a self-declaration, not a third-party certification.
CSA STAR Level 1
We have completed the Cloud Security Alliance (CSA) Consensus Assessments Initiative Questionnaire (CAIQ) for Revenue CRM as a self-assessment, and our answers are published in the CSA STAR Registry (October 2026).
CSA STAR for AI Level 1
We have also completed CSA’s AI questionnaire (AI-CAIQ, mapped to the AI Controls Matrix) for the AI features in Revenue CRM as a self-assessment, and our answers are published in the CSA STAR Registry (October 2026).
Security program
Our internal security rules cover incident response, business continuity and recovery, secure development and change and vulnerability management, people, devices, suppliers and data, and the use of AI. They are reviewed at least once a year. We have run a restore test from backup, an incident-response tabletop exercise, and security training for staff, and we keep records of each.
Infrastructure certifications
Revenue CRM runs on Vercel (SOC 2 Type 2, ISO 27001:2022) and Supabase (SOC 2 Type 2). These certifications belong to those providers, not to Consilegy.
Company
How we work
Internal practices
Two-factor authentication on the cloud services we use for work, a password manager with no reused passwords, least-privilege access, prompt removal of access when a contract ends, encrypted work devices with antivirus, customer data kept in the cloud rather than on personal devices, and confidentiality agreements and regular training for staff and contractors.
Incident response
We follow a defined procedure: report, initial response, impact assessment, notification, and prevention of recurrence. Under the Revenue CRM Terms of Service, we notify customers promptly, and no later than 3 business days after, we learn of a leak or other incident involving personal information they entrust to us, and we support the reports and notices they need to make.
Revenue CRM
Product security
Data residency
The database, file storage, and application runtime are all in Japan (Tokyo region).
Data handled by AI features (the text you enter, plus stored records the AI features draw on, such as contacts, deals, and meeting notes) is processed by US AI providers (Anthropic, OpenAI, Google). Email sent from the service is processed by a US provider (Resend). You can switch AI features to an AI provider your company contracts with directly.
Encryption
All traffic is encrypted with TLS, and HSTS tells browsers to use encrypted connections only. Stored data and files are encrypted at rest (AES-256) by our infrastructure provider, Supabase.
Credentials for connected services (access tokens and API keys) are additionally encrypted with AES-256 by the application.
Revenue CRM API keys are stored as hashes.
Tenant isolation
Each company’s data is isolated by row-level security (RLS) in the database.
For server-side processes that run outside RLS, every change is automatically checked for code that handles data across companies; cross-company processing is allowed only where the reason is recorded. Missing RLS on new tables is also detected automatically.
Access control
Roles (owner, admin, member), per-object permissions to view, create, edit, delete, and export, and visibility scopes (everyone, team, own records).
Authentication
Sign in with an email address and password, or a Google account.
Multi-factor authentication with authenticator-app codes and backup codes is supported. If a user loses their device, an admin in the same company can reset it. The sign-in page is protected against automated attacks. Resets by an admin are recorded in the audit log.
Audit logging
Creating, changing, and deleting contacts, companies, and deals, and every data export, are recorded with the user and time. Logs are kept for the term of the contract and admins can view them in Settings.
Backups
The database is backed up automatically every day, with the last 7 days retained.
Uploaded files are copied daily to a separate storage area within the same infrastructure provider, also kept for 7 days.
AI and your data
Your data is never used, by us or by the AI providers we contract with, to train AI models. Our contracts with those providers exclude training.
This does not apply to an AI provider you connect with your own key, which is governed by that provider’s terms. Providers may retain submitted content for a limited period to monitor abuse.
AI safeguards
Customer data and search results passed to AI are, as a rule, kept separate from instructions. Text that looks like an attempt to manipulate the AI is detected and recorded in our server logs.
AI-generated content is labeled as such on the main screens. Admins can turn off all AI features for their company.
AI inputs and outputs are logged and deleted automatically after 90 days.
Vulnerability management
Updates and vulnerability alerts for the third-party software components we use reach us automatically, and we review them and apply updates based on severity. We also accept reports from security researchers (see below).
Retention and deletion
For 30 days after the contract ends, you can export your data to CSV from Settings.
After that, data in the live environment is deleted, and copies in backups are deleted when the 7-day retention period ends.
Privacy
Data protection and cross-border transfers
We act as a processor for the customer data you store in Revenue CRM. Your data belongs to you, and we handle it only to provide, maintain, and support the service, to meet legal obligations, and to produce statistics that cannot identify individuals or customers.
We comply with Japan’s Act on the Protection of Personal Information (APPI). The European Commission has recognized Japan as providing an adequate level of data protection. Your data is stored in Japan; AI and email processing take place in the US under the safeguards below. Where data is processed by providers outside Japan (listed below), we confirm in our contracts with them: purpose limitation including no model training, encryption and access control, flow-down obligations to their own providers, breach notification, and deletion after processing.
If your organization needs a data processing agreement (DPA), the EU Standard Contractual Clauses, or answers in your own format, contact us at [email protected].
Subprocessors
Providers that handle customer data
| Provider | Purpose | Data | Processing location | Headquarters |
|---|---|---|---|---|
| Supabase Pte. Ltd. | Database and file storage | All customer data | Japan (Tokyo) | Singapore |
| Vercel Inc. | Application runtime | Customer data passing through for processing | Japan (Tokyo) | United States |
| Anthropic, PBC | AI features | Text sent to AI features | United States | United States |
| OpenAI OpCo, LLC | AI features, transcription, text embeddings | Text and audio sent to AI features | United States | United States |
| Google LLC | AI features, image reading | Text and images sent to AI features | United States | United States |
| Plus Five Five, Inc. (Resend) | Email sent from the service | Email body and recipients | United States | United States |
Payment (Stripe, PayPal), sign-in bot protection (Cloudflare), and rate limiting against abuse (Upstash, processed in Tokyo) handle only our own billing data, connection data, and the account identifiers needed for rate limiting, not the customer data you store. Integrations you connect yourself (for example, Zoom, Google Meet, LINE, and Slack) are governed by your own agreements with those providers. We give customers 30 days’ notice before changing this list, and customers who object may cancel. The binding list is in the Revenue CRM Terms of Service (in Japanese).
Vulnerability Reporting
Report a security issue
If you believe you have found a vulnerability in our website or Revenue CRM, email [email protected] with the details and steps to reproduce it. We will acknowledge your report within 3 business days and keep you updated. Please use only accounts and workspaces you created yourself, do not access or change other people’s data, and do not run denial-of-service tests or social engineering. If you research in good faith under these rules, we will not take legal action against you, and this page serves as our written permission under section 6(4) of the Revenue CRM Terms of Service. The full policy is on our Japanese page.
Download
Security questionnaire
Ready-to-paste answers to the questions security reviews usually ask, covering organization, people, access, devices, data, Revenue CRM, and data protection (as of October 2026). No sign-up required.
Download the questionnaire (spreadsheet)
For questions not covered here, or answers in your own format, contact [email protected]. We reply in English or Japanese.