Security overview
Relationship CRM uses authenticated identity and server-side workspace membership checks. Roles and separate permissions govern editing, exports, integrations and user administration. Customers should assign the least access each person needs.
Connections and access
Google credentials are encrypted in server storage and bound to the signed-in user and workspace. Account suspension and integration disconnection are separate controls. Review access regularly and disconnect unused accounts. A CRM workspace visit record is not a complete identity-provider device-session inventory.
Important boundaries
We do not claim independently verified certification or HIPAA readiness. Platform MFA enforcement, recovery evidence and provider contracts require separate verification. Never store PHI or clinical records in this deployment.
Report a concern
Email simonmittal@envisage-health.com with the affected feature and time. Do not include credentials or sensitive content. Pause an affected import if it is bringing in prohibited data.