Trust center

The questionnaire, answered first

Everything procurement asks for, on one page · support@glimecrm.com answers anything missing within 2 business days

Claims and evidence

Every capability this site claims, what state it is really in, and the test that proves it. The table is generated from config/claims.json, and CI fails if a page states a roadmap item as shipped, if a shipped claim's test disappears, or if this table falls out of date. A young vendor has no logo wall to show you. It can show you its tests.

ClaimStatusWhat proves it
Every query is scoped to its workspace; another workspace's reads are refusedShippedBackend test: “a different workspace cannot see Acme's records (tenant isolation)”
Backend test: “a workspace's CPQ configuration and its history are invisible to every other workspace”
Discount approvals are ordered, role-gated and decided by the serverShippedBackend test: “submit built the correct chain: Sales Manager -> Regional Director”
Backend test: “Director cannot approve out of order (Manager must go first)”
npm run check:cpq on every change
Nobody can approve their own quoteShippedBackend test: “a Manager cannot approve their own quote”
A discount beyond the workspace's ceiling cannot be finalizedShippedBackend test: “60% discount is refused finalization”
Every change, approval, sign-in and failed sign-in lands in the workspace audit trailShippedBackend test: “every mutation landed in the workspace audit trail”
Six roles with record-level visibility: reps see their own records, managers their team'sShippedBackend test: “Sales Rep sees own + assigned records only”
npm run check:roles on every change
12-character minimum, screened against a breach list and your own detailsShippedBackend test: “password policy refuses short, breached, patterned, and personal passwords”
Account lockout and a spray ceiling on sign-inShippedBackend test: “login locks after repeated failures”
A password change, or an Admin, ends every session at onceShippedBackend test: “a password change revokes every token issued before it”
Backend test: “an Admin can sign a departing teammate out of every device immediately”
Self-serve full export on every plan, lapsed workspaces includedShippedBackend test: “the workspace export reads Postgres, needs data:export, and obeys row visibility”
Backend test: “an expired term makes the workspace read-only, keeps reads and exports working”
Delete-my-data runs server-side and keeps the audit log that records itShippedBackend test: “erases Postgres rows, needs a typed confirmation, and is Admin-only”
Only an approved quote can be sent; the customer never sees cost or marginShippedBackend test: “an approved quote reaches the customer, they accept it once, cost never leaves the building”
Each approval step pages whoever holds it, in orderShippedBackend test: “every approval step pages whoever holds it, in order”
Every quote line is priced from your workspace's own catalog — a price typed below it is counted as a discount, and cost can't be left off to dodge the margin floorShippedBackend test: “quotes are priced from the workspace's catalog”
An accepted quote becomes its sales order and contract with one click, carrying its lines and approval certificateShippedBackend test: “an accepted quote becomes its sales order and contract”
Moving off another CRM is one import: columns matched by header, duplicates skipped, HubSpot read directly through its API, and every import undoable on its ownShippedBackend test: “moving off HubSpot is an import”
Quotes, approval requests, the catalog and the Quote Builder setup belong to the workspace — a request a rep sends is in the approver's inbox on any deviceShippedBackend test: “the app's quote lifecycle runs on the server”
Backend test: “the Quote Builder setup is one versioned workspace document”
The checkout total is re-priced on the server and must agree with the browser to the centShippednpm run check:prices on every change
Checkout test: “a cart posted with its own totals is charged the SERVER's price”
A lapsed workspace becomes read-only, never locked outShippedBackend test: “an expired term makes the workspace read-only”
High and critical dependency advisories fail the backend buildShipped.github/workflows/backend.yml
Approvers decide from their email or a Slack button — a one-tap link that works once, never decides on its own, and checks their role at the moment they tapShippedBackend test: “a decision link decides once — GET only renders, a second use is refused”
Backend test: “a link carries no authority of its own: the approver's CURRENT role decides”
Backend test: “re-submitting a quote kills every outstanding link”
Your approvals go to your own Slack or Teams channel; the operator's channel never carries your deal dataShippedBackend test: “a workspace connects its own Slack channel”
Backend test: “the deployment-wide operator webhook carries no customer's deal data”
The audit trail is a hash chain the database refuses to rewrite, verifiable offline from your own exportShippedBackend test: “the audit trail is a hash chain the database refuses to rewrite”
Checked in CI: only server/audit.js may write it
scripts/verify-audit.mjs
Every approved quote carries a certificate over exactly what was approved, a later edit shows up, and the order pushed to your ERP cites itShippedBackend test: “an approved quote carries a certificate over exactly what was approved”
npm run check:adapters on every change
The 30-day money-back guarantee is a button, not an email — and a refund deletes no dataShippedCheckout test: “the money-back guarantee is a button”
Checkout test: “a refund takes back exactly what its order bought”
Nothing renews itself; billing admins are told 30, 7 and 1 day before a term endsShippedCheckout test: “renewal notices go out once each before the term ends”
The per-seat price you paid is held for renewals for 12 monthsShippedCheckout test: “a renewal is priced at the per-seat price the workspace paid”
npm run check:prices on every change
Your outside bookkeeper or controller can hold a role in your workspace — usually the Finance rung — with their own two-factor sign-in, without taking a seat, revocable on their next click, and on the audit trail under their firm's nameShippedBackend test: “a client invites its outside controller by email”
Backend test: “an advisor holding the client's Finance rung is paged for it”
Backend test: “a person who belongs to two workspaces sees only the active one”
Backend test: “revoking an advisor refuses their very next request”
Advisor programme
Five industry starter packs import as a staged draft the server accepts, and every number on their pages is priced by the engineShippedBackend test: “every industry pack”
npm run check:cpq on every change
Industry packs
Your customer accepts on the quote link with a record that holds up — a code-verified address, intent, e-sign consent, IP and the fingerprint of exactly what they saw — can require a second signer, asks for changes in words, and pays on the invoice link your own ledger replies withShippedBackend test: “an acceptance records intent, e-sign consent, a code-verified address”
Backend test: “a quote can require a second signer on the buyer's side”
Backend test: “a buyer can ask for a change but never edit a price”
Backend test: “the page shows the payment link the ledger replied with”
npm run check:adapters on every change
A monthly governance report — what the discount policy routed, let through and cost — sent to whoever renews and whoever holds the ceiling, with a forwardable readout that carries figures, never recordsShippedBackend test: “the governance report matches a hand-computed month”
Backend test: “a readout link is aggregate-only”
Backend test: “the monthly report goes to the Admin and the ceiling's approver once per period”
npm run check:cpq on every change
The leakage audit runs your own quote history through the engine that prices a live quote, in your browser — the page's security policy forbids it from uploading anythingShippednpm run check:cpq on every change
site/leakage-audit.html
site/js/leakage.js
A standard, signable DPA and a published subprocessor listShippedDPA
Subprocessors
Two-factor sign-in on every plan, a workspace setting that requires it, and a fresh second factor for large approvalsShippedBackend test: “two-factor sign-in verifies something now”
Backend test: “a workspace can require two-factor sign-in”
Backend test: “a large approval can require a fresh second factor”
Sign in with Google or Microsoft, on every plan — and colleagues on your verified domain can join without an inviteShippedBackend test: “Sign in with Google checks the signature, audience, expiry, nonce and a single-use state”
Backend test: “a workspace proves its email domain with a DNS record”
A list of every signed-in device, each one revocable on its ownShippedBackend test: “every session is listed and can be signed out on its own”
Postgres row-level security walls every signed-in request to its own workspace, as a second net under the application's tenant filterShippedBackend test: “Postgres row-level security walls every request to its workspace”
Checked in CI: only server/db.js, server/auth.js, server/routes/auth.js, server/routes/advisors.js may write it
Field-level securityPartial — Fields your admin adds are withheld or masked by the server; rules on built-in fields are hidden on screen onlyBackend test: “a rule on an added field is enforced where the value now lives”
npm run check:fields on every change
A QuickBooks Online connector — sign in with Intuit, customers and items referenced by Id, an hourly sync — pushes approved quotes and pulls orders backPartial — Beta until it has run against an Intuit sandbox company; nine more connectors are tested against simulators only and not offered — see /integrations/#statusBackend test: “QuickBooks Online connects by signing in at Intuit”
npm run check:adapters on every change
Backend test: “and not one of the ten payloads carried cost, margin, or an internal reason code”
Approval decision links, acceptance codes and password resets are emailed from glimecrm.com, DKIM-signed, through Postmark, Resend or SendGridPartial — Built and tested; the hosted service needs its provider and the provider's DKIM key under glimecrm.com (DMARC is p=reject) — docs/operations/EMAIL-DNS.md phase 3, proven with npm run check:email. /api/health and the outside check report whether email is liveBackend test: “whether email leaves this server is on /api/health and in Settings”
Email BCC'd or forwarded from Outlook or Gmail to the workspace's log address lands on the contact, or on the account of the quote it namesPartial — Built and tested; offered once the hosted service's inbound mail domain is set up (EMAIL-DNS.md phase 4). A log address, not a mailbox syncBackend test: “email logs from Outlook or Gmail by BCC or forward”
TLS 1.2+ in transit; the credentials and secrets you give us sealed with AES-256-GCMPartial — TLS at the CloudFront edge and again at Caddy on the server. The database itself runs on one Lightsail server's disk, not a managed encrypted serviceserver/integrations/vault.js
Nightly database backups, a daily off-server snapshot, and a scripted restore testPartial — No point-in-time recovery yet: up to a day of changes could be lostinfra/lightsail/backup-db.sh
scripts/backup-verify.sh
SAML single sign-onRoadmapNot shipped — target 2027
SOC 2 Type I reportRoadmapNot shipped — target Q4 2026
Annual third-party penetration testRoadmapNot shipped — target Q4 2026
Model-backed Glime AI: metered credits, drafting and scoringRoadmap — Record pages carry a summary card today, written from the record's own fields by a template (docs/ai-implementation.md)Not shipped — target 2027
Scoped API keys, metered quotas and a GraphQL endpointRoadmapNot shipped — target 2027
Argon2id password hashing (bcrypt cost 10 today)RoadmapNot shipped — target 2027
99.9% monthly uptime target (99.95% Enterprise)Operator commitmentA target, not yet an SLA: credits begin once the outside check (.github/workflows/uptime.yml) has 90 days of history; see the status page

Availability

PlanMonthly uptime target
Starter / Professional99.9%
Enterprise99.95%

Targets, not yet an SLA: the service runs on one server, and credits begin once an outside check has 90 days of measured history behind them.

Live status and incident reporting: the status page. It publishes no uptime figure an independent monitor didn't measure.

The no-lock-in guarantee

"Easy to leave" is a feature, and it's published so it can't quietly disappear:

  1. Self-serve full export, any time: Settings → Your data → Export. Every record, related object, and your complete audit log in documented JSON (CSV per object also available). No support ticket, no retention call.
  2. On cancellation: your workspace becomes read-only for 60 days with export still available, then data is deleted — with written confirmation.
  3. On request: deletion executes within 30 days at any time under GDPR/CCPA, including backups on their rotation schedule.
  4. No exit fees. No export throttling. No "talk to your account manager."

Test it in the sandbox — the export button works there too.

Documents & contacts