- Contacts, companies, deals & calendar
- Money, documents, e-sign & payments
- Private by design — your data is yours
Security & Trust
Last updated: September 4, 2026
Contact Coordinator is built so your relationships and your data stay yours. This page explains, in plain terms, how we protect the information you and your contacts entrust to us. For how we handle personal data and your rights, see our Privacy Policy.
Encryption
- In transit: every connection uses HTTPS/TLS. We tell browsers to always use HTTPS for the site (HSTS).
- At rest: sensitive secrets — such as the access tokens for services you connect (Gmail, Outlook, bank feeds) and your two-factor secret — are stored encrypted. Passwords are never stored in plain text; they are salted and hashed.
Accounts & authentication
- Invitation-only. Accounts are created deliberately, not by open self-signup.
- Two-factor authentication (2FA) is available to every user, and encouraged for staff.
- Sign in with Google or Microsoft is supported, so you can use your existing secure identity.
- Failed sign-ins are rate-limited, and temporary passwords must be changed on first use.
Access control & isolation
- Each network's data is private to its members. Access is enforced on every request.
- Roles (Leader, Co-leader, Editor, Viewer) let you grant exactly the access each teammate needs — down to which sections they can see.
- Our team cannot browse your data at will. If you ever need hands-on help, you can grant time-limited support access from your Account page, and revoke it anytime. Every such session is logged.
Monitoring & audit trail
Security-relevant actions are recorded in an audit log (sign-ins, permission and ownership changes, deletions, and administrative actions), so activity can be reviewed if a question ever arises.
Your data lifecycle
- Export anytime. You can download your network data.
- Delete on your terms. Deleted records go to a Recycle Bin for 30 days, then are permanently removed. You can delete your whole account from your Account page.
Application hardening
The app is built with standard protections against common web attacks: a strict Content-Security-Policy, anti-CSRF tokens on forms, database access through parameterized queries, escaped output, secure session cookies, and modern security response headers.
Infrastructure & backups
The Service runs on a reputable managed U.S. host with regular server backups. Application secrets are kept outside the web root and never stored in the browser.
Privacy & compliance
We align our practices with major privacy laws, including the California Consumer Privacy Act (CCPA/CPRA), other U.S. state privacy laws, and the EU/UK GDPR. Business customers who need a Data Processing Agreement (DPA) can request one. We continue to strengthen our program over time. See the Privacy Policy for details and your rights.
Reporting a vulnerability
We welcome responsible disclosure. If you believe you've found a security issue, please email security [at] contactcoordinator.com with the details and steps to reproduce. Please don't publicly disclose it until we've had a reasonable chance to fix it. We're grateful for reports that help keep everyone safe.