Security Policy
How XtraCRM approaches access control, protection of customer information and secure service operation.
Purpose and scope
This policy sets out the security principles for XtraCRM, provided by Flexpay Finansal Yazılım Teknolojileri AŞ. It covers the application, customer information, integrations and the people responsible for operating the service. The policies in this centre describe our security requirements; they are not an independent audit or certification.
Access and accountability
Access must be limited to authorised users and the permissions needed for their responsibilities. Company boundaries and user permissions must be respected when viewing, changing or transferring information. Users must keep their credentials confidential, use individual accounts and remove access that is no longer needed. Integration access should be limited to the capabilities required by the customer.
Protection of information
Customer information must be used only for authorised service purposes. Credentials and integration secrets must not be published, included in support screenshots or stored in public source files. Security reports should contain only the information necessary to investigate a problem. Applicable retention, deletion and personal data requirements are addressed in our Privacy Policy.
Secure changes and operation
Changes affecting authentication, permissions, company isolation or integrations must be reviewed and tested before release. Security-relevant errors and reported vulnerabilities are assessed through the procedures linked below. Operational information that could help an attacker is kept out of public policy documents.
Shared responsibilities and review
Customers are responsible for assigning appropriate permissions, managing their users and protecting connected third-party accounts. XtraCRM is responsible for the security of the service within its control. Policies should be reviewed following material service changes or security incidents. Report suspected security issues through the contact channel below.
Security questions and reports
Contact XtraCRM about a suspected security issue or a question about these policies. Include a brief description and the affected service; do not include passwords, access tokens or unnecessary personal information.
Contact XtraCRM →