This page states facts only. Each one can be checked against our code, our settings, or the named provider's own published documentation, which we link.
RepHubCRM is a trade name of Edge of Inference LLC. Mailing address: 201 Rue Beauregard, Ste 202, Lafayette, LA 70508.
Encryption in transit
- The app is hosted on Vercel. Vercel serves every page over HTTPS, redirects plain HTTP requests to HTTPS, and supports TLS 1.2 and TLS 1.3 (Vercel: Encryption and TLS).
- On our domain, Vercel sends a Strict-Transport-Security (HSTS) header by default, which tells browsers to use HTTPS only. We have not changed that default.
- The app connects to its database over an encrypted (TLS) connection.
Encryption at rest
- Our database is hosted by Supabase, which encrypts all customer data at rest (Supabase: Security).
- Two secrets you can connect to your account are also encrypted by the app before they are saved: your Google Calendar connection token and an email account (SMTP) password.
Payments
- Payments are processed by Stripe. You enter card details on Stripe's own checkout page, so card numbers never reach our servers and we do not store them.
- Your billing page shows only the card brand, the last four digits and the expiry date, which it reads from Stripe. Changing a card happens in Stripe's billing portal.
Signing in
- Passwords are stored only as bcrypt hashes, never as plain text.
- Repeated failed sign-in attempts are limited, per email address and per network address.
- A password reset link expires after one hour and stops working once it has been used or the password has changed.
- Changing your password signs out your other sessions within about five minutes.
- You can sign in with Google instead of a password. Only email addresses that Google has verified are accepted.
- Two-factor sign-in is not offered yet.
Who processes your data
Every third party that processes customer data, what it does and where, is listed on our Subprocessors page.
Deleting your data
To have your account and its data deleted, email privacy@rephubcrm.com. The app has no self-serve delete button yet, so deletion is done on request. Under our Privacy Policy, active account data is deleted within 30 days of termination and backup copies within 90 days. Some records may be kept longer for legal, dispute or fraud-prevention reasons, as the Privacy Policy describes.
AI and your data
- The AI work in the product runs on Anthropic's Claude models through Anthropic's commercial API. The /talk voice agent also uses OpenAI's API to turn speech into text and text into speech.
- We do not train or fine-tune any AI model on customer data. Our code sends requests to these APIs and has no training step.
- Anthropic's Commercial Terms of Service state: "Anthropic may not train models on Customer Content from Services." (Anthropic: Commercial Terms)
- OpenAI states that data sent to the OpenAI API is not used to train or improve OpenAI models unless the customer explicitly opts in to share data (OpenAI: Data controls).
Status and changes
Live component status is on our Status page, and customer-visible changes are listed in the Changelog.