Infrastructure and Dependency Management Policy
Security requirements for operational access, component updates, releases and external service dependencies.
Scope and ownership
Operational resources and third-party components supporting XtraCRM must have a defined purpose and a responsible maintainer. Changes should account for the affected service, dependencies and customer impact. Public documentation must not expose credentials, internal addresses or detailed operational topology.
Operational access and configuration
Administrative access must be restricted to authorised maintainers and removed when no longer necessary. Separate secret values from public code and documentation. Review configuration changes that affect authentication, exposure of services, customer information or integration access. Production credentials must not be used in public examples or test fixtures.
Updates and dependencies
Review security advisories and the support status of components used by the service. Assess relevant updates according to risk, compatibility and exposure. Prioritise actively exploited issues and components that protect sensitive operations. Remove or replace unnecessary or unsupported dependencies where appropriate.
Release and recovery planning
Review and test changes before release, particularly those affecting data, permissions and external connections. Consider rollback or recovery requirements before changes that may affect service availability or stored information. Recovery arrangements and access to recovery materials must protect customer confidentiality. This policy does not define a public uptime, backup-frequency or recovery-time guarantee.
External services and periodic review
Assess the permissions and information required by external integrations. Review dependencies after significant service changes or incidents, and address risks that arise from unavailable or changed third-party services. Customer-controlled integrations remain subject to the customer's settings and the external provider's terms. Review this policy as operational requirements change.
Security questions and reports
Contact XtraCRM about a suspected security issue or a question about these policies. Include a brief description and the affected service; do not include passwords, access tokens or unnecessary personal information.
Contact XtraCRM →