Hosting and management
AppWT wrote the CRM and runs it on a server AppWT manages in a United States data center in Virginia.
HTTPS only
Every page is served over HTTPS, and browsers are told to use HTTPS for a full year (HSTS).
Sessions
The sign-in cookie is Secure, HttpOnly and SameSite=Lax. The session itself is stored on the server, outside the website folder.
Passwords and lockout
Passwords are stored as one-way hashes, never as text. An account locks after repeated failed sign-ins.
Forms
Forms inside the CRM carry anti-forgery tokens, so another site cannot submit them on your behalf.
Security headers
Other sites cannot frame the CRM, browsers may not guess file types, and full page addresses are not sent to other sites.
Roles and access
Each user sees what their role allows, with per-user overrides. A login can be limited to certain websites on an account.
Audit log
Sign-ins, exports, permission changes and record edits are written to an audit log that shows who did what, and when.
Backups and export
The data is backed up every night, and contacts and leads export to a spreadsheet file at any time.
Spam at the door
The public lead form drops spam with a hidden-field trap, and messages that are not in English never reach the CRM.
Text consent
Text consent is recorded per contact with the exact words shown, delivery receipts are kept, and STOP is honored automatically.
Report a problem
Security reports go to security@appwt.us. Our security.txt file lists the contact for researchers.
Your data, your rules
Your customer data belongs to you. How we collect, use and protect personal information is set out in the Privacy Policy, the rules for using the service are in the Terms of Service and the Acceptable Use Policy, and the cookies this site sets are listed in the Cookie Notice.