Security & Data Isolation

1. Security Design Principles

Ridhzo is designed on the principle of least privilege and strict separation between workspaces. Because the platform handles inbound enquiries and deal pipelines, every layer is built to prevent unauthorized access and data leakage:

2. Workspace Isolation

Ridhzo runs on PostgreSQL, with workspace boundaries enforced in the application on every request:

• Workspace scoping: Every lead, note, custom field, pipeline stage and sequence belongs to exactly one workspace, and every query is limited to the signed-in person's workspace.
• Parameterized queries: Database queries use typed, parameterized statements. Raw user strings are never concatenated into SQL, which removes the SQL-injection attack surface.
• Permissions checked on the server: What a person can see or do is enforced by the server on every request — not just hidden in the interface. Sales reps can open only the leads assigned to them.

3. Encryption

4. Webhook Integrity & HMAC Verification

Because leads stream in from external advertising networks, we verify the authenticity of incoming requests before parsing them:

• Meta Facebook Lead Ads: We inspect the X-Hub-Signature-256 header on every inbound webhook, verifying the SHA-256 HMAC payload against your App Secret. Payloads with invalid or missing signatures are rejected before anything is saved.
• Google Lead Form and website webhooks: Inbound requests are matched against the secret key configured for that source. Optional HMAC signatures are supported for custom webhooks.
• Outbound webhooks are signed (HMAC-SHA256), so your systems can verify a delivery came from Ridhzo. Public forms and webhooks are rate-limited against spam.
• Duplicate protection: Retried deliveries don't create duplicate leads.

5. Mobile Apps & Offline Data

Ridhzo lets reps in the field add new leads even without a network connection. How that data is handled depends on how the app is installed:

• Web app (PWA): Offline mode holds only leads a rep has just added. Existing leads are not downloaded for offline use. Pending leads are kept in the browser's storage for the Ridhzo app, separated per workspace and not readable by other websites.
• Android app: To work offline and to identify callers, the app keeps a copy of the leads that person is allowed to open on the phone. We recommend a screen lock on work phones, and a lost phone's access can be cut off by deactivating the user.
• Call logging stays private: The Android app matches its call log against your leads' numbers and sends only those calls. Personal calls never leave the phone, and nothing is read until the rep grants the call-log permission.
• Normal checks on sync: When the connection returns, each offline lead goes through the same signed-in, permission-checked path as any other new lead — including duplicate detection.

6. Role-Based Access Control (RBAC)

Every person has a role. Ridhzo ships an Admin and a Member role, and you can create custom roles from 14 separate permissions:

Someone who can invite people but cannot manage roles is not able to hand out a role with more access than they hold themselves.

7. Deletion, Retention & Recovery

You stay in control of your data, including when it leaves Ridhzo:

• 30-day recycle bin: Deleted leads can be restored for 30 days, guarding against accidental deletion.
• Permanent deletion: People with the purge permission can erase leads for good, and a lead's data can be exported or erased on request.
• Export: Leads can be exported to CSV by people with permission.
• Audit trail: Deletions, merges and permission changes are recorded with who did them and when.

8. Responsible Vulnerability Disclosure

We welcome collaboration with independent security researchers to uncover potential flaws. If you discover a security vulnerability in Ridhzo: