Security at Glime
Glime holds your revenue data — pipeline, pricing, contracts. This page states plainly what we do to protect it, what's independently verified, and what's still on the roadmap. Where we aren't done yet, we say so.
Data protection
- Encryption in transit: TLS 1.2+ everywhere; HSTS enforced on all public endpoints.
- Encryption at rest: AES-256 for databases, file storage, and backups.
- Tenant isolation: row-level tenancy enforced in the data layer, not in application code paths that can forget.
- Backups: continuous, encrypted, tested restores quarterly.
Access control
- RBAC with configurable roles, plus field-level and row-level security — a rep can see their accounts without seeing executive-only margin fields.
- SSO/SAML and enforced MFA (Enterprise plan); TOTP MFA available on all plans.
- Session policy: 12-hour idle expiry, revocable sessions, device list per user.
- Password policy: minimum 12 characters, breach-list screening, Argon2id hashing.
Auditability
Every mutation — record changes, quote versions, discounts, approvals, imports, exports, sign-ins — is written to an append-only audit log with actor, timestamp, and detail. Quote pricing keeps every calculation; nothing is permanently overwritten. See the audit trail live in the sandbox.
Application security
- Strict Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers on every response.
- Output encoding on all user data; the API is the only write path — no direct database access exists for extensions.
- Dependency scanning and Lighthouse/security budgets in CI on every change.
Compliance roadmap — the honest version
| Item | Status | Target |
|---|---|---|
| SOC 2 Type I | Controls implemented; audit firm engaged | Q4 2026 |
| SOC 2 Type II | Observation window follows Type I | Q2 2027 |
| GDPR | DPA, subprocessor list, export & deletion live | Available now — DPA |
| CCPA | Covered by the same rights tooling | Available now |
| Penetration test | Annual third-party test | First report Q4 2026, summary published to the trust center |
Data residency
Primary hosting in the United States; EU data residency (Frankfurt) ships with the hosted backend for Enterprise workspaces. Current subprocessors and regions are listed here.
Reporting a vulnerability
Email security@glimecrm.com. We acknowledge within 24 hours, don't pursue good-faith researchers, and credit fixes in the changelog if you'd like the mention.