Measures currently implemented
- HTTPS encryption for communications.
- Server-side access control for the CRM and its APIs.
- Password derived with scrypt and a random salt; no plaintext password in the database.
- Random sessions, Secure, HttpOnly and strict SameSite cookie, limited expiry.
- Input validation, prepared queries, write-origin checks and size limits.
- Private data excluded from public resources and CRM responses marked no-store.
- Mail gateway key encrypted server-side and excluded from commercial backups.
- Exportable manual backups and automated tests for sensitive controls.
Limits and vigilance
No system can guarantee zero risk. Access, backups, dependencies and providers must be reviewed regularly. Any new connection, AI feature or data collection must be assessed before activation.
Report an incident
To report a vulnerability or potential incident, email contact@karvanis.be with a factual description, without further exploiting the issue or attaching unnecessary personal data.