Security is the product

We request only read scopes from the Attio API. CRMDataSafe is technically unable to create, modify or delete anything in your workspace — the permission simply doesn't exist on our token.

Backups stream from Attio directly into your own Google Drive or OneDrive. We hold no copy of your CRM data. Revoke our access at any time and we're locked out instantly.

OAuth tokens are encrypted at rest with AES-256-GCM using keys that never leave our secret manager. Tokens are never written to logs and never exposed to the browser.

Every database row is protected by Postgres row-level security. Your account can only ever see its own connections, schedules and run history.

We store metadata only: run timestamps, record counts and error messages. The backup content itself lives exclusively in your cloud storage.

On Google Drive we use the drive.file scope, which only grants access to files CRMDataSafe itself creates — we cannot see the rest of your Drive.