Your business data is sensitive. SME System is built with security and privacy at its core, ensuring your contacts, leads, quotes, and products are protected at every level.
Row-Level Security (RLS)
What Is RLS?
Row-Level Security is a database-level security feature that ensures each organisation can only access its own data. Unlike application-level checks that can be bypassed by bugs or misconfiguration, RLS is enforced directly by the database.
How It Protects You
- Every query to the database is automatically filtered by
organisation_id - Even if a bug in the application tried to access another organisation's data, the database would refuse
- No user can see, edit, or delete data belonging to another organisation
- This applies to contacts, leads, products, quotes, and all other business data
Why This Matters
Many SaaS tools rely solely on application-level security — meaning a single bug could expose other customers' data. SME System's RLS approach means security is enforced even if the application layer has a vulnerability.
Data Encryption
In Transit
All data sent between your browser and SME System servers is encrypted using TLS (Transport Layer Security). This means:
- Your password is never transmitted in plain text
- Contact details and quote data are encrypted while being sent
- Nobody can intercept and read your data on the network
At Rest
All data stored in the SME System database is encrypted at rest. This includes:
- Contact names, addresses, and VAT numbers
- Lead details and pipeline information
- Product prices and descriptions
- Quote line items and totals
UK GDPR Compliance
Data Storage
- All SME System data is stored in secure, encrypted databases
- Data is hosted in the EEA (European Economic Area)
- Your data is not shared with third parties for marketing purposes
Your Rights
Under UK GDPR, you have the right to:
- Access: Export all your data at any time from Settings → Data
- Rectification: Edit any contact, product, or quote at any time
- Erasure: Permanently delete your account and all associated data
- Portability: Export data in CSV or JSON format
Data Retention
- Your data is retained as long as your account is active
- When you delete your account, all data is permanently removed within 30 days
- Cancelled subscriptions retain data for 90 days in case you reactivate
Access Control
Role-Based Access
SME System enforces role-based access control:
- Admins can access all modules and settings
- Members can access operational modules (CRM, Contacts, Products, Sales)
- Billing and organisation settings are restricted to Admins only
Session Security
- Sessions expire after a period of inactivity
- You can view and revoke active sessions from Settings → Security
- Two-factor authentication adds an extra layer of protection
Best Practices for Your Team
Strong Passwords
Require your team to use strong passwords:
- Minimum 8 characters
- Mix of uppercase, lowercase, numbers, and symbols
- Unique passwords not reused from other services
- Use a password manager
Enable 2FA
Encourage all team members — especially Admins — to enable two-factor authentication. This prevents unauthorised access even if a password is compromised.
Regular Access Reviews
Review your team member list monthly:
- Remove members who have left the organisation
- Downgrade Admins who no longer need full access
- Verify that only current employees have access
Data Hygiene
- Don't store more personal data than you need
- Keep contact records up to date
- Remove inactive or duplicate contacts periodically
- Follow your organisation's data retention policy
Reporting a Security Concern
If you believe you've found a security vulnerability or have a data privacy concern:
- Contact us immediately through the Contact page
- Do not publicly disclose the issue
- We will acknowledge receipt within 48 hours
- We will investigate and respond with a resolution timeline
Next Steps
