Security

Effective 12 October 2026.

sofatofu is built for agents that work without supervision. We check CRM writes before we apply them, record changes, and let you reverse most changes.

Where your data lives

Our server and database run on Railway in Singapore. Traffic to sofatofu.com uses HTTPS through Cloudflare.

Who can see your data

Only workspace members can access its data through sofatofu. For each request for workspace data, the server checks that you are still a member.

A workspace has two roles: owner and member. Only an owner can configure the workspace, invite or remove members, or delete the workspace.

At sofatofu, only the person who runs it can open the database, and only to fix a problem.

We do not use passwords. You sign in with an email code, Google or LinkedIn. We store only a hash of each code. Codes expire after 10 minutes. We limit sign-in attempts per IP address.

The CLI signs in through your browser. The approval page shows the request's location, IP address, when it was made, CLI version and operating system. The CLI keeps its token in the secret store of your operating system.

A session ends about 7 days after you last use it. The portal lists your sessions. You can end any of them.

What we do with your data

We never put CRM data in usage data or send it to an AI provider. Your own agent reads your CRM data through your session.

We do not sell data. See our providers for the services we use and the data they receive.

A record of changes

For each change to a CRM record or workspace setting, we record who made it, when, and the reason given. We also record changes to member access. We keep this history for 30 days.

You can reverse changes to CRM records and workspace settings, and restore deleted records, for 30 days. We refuse a reversal if a later change touched the same record. You cannot reverse changes to member access, such as invitations and removals.

We refuse a write if the data returned by the read it relies on has changed.

When you delete a workspace, we delete its data and its history. You cannot restore it.

If something goes wrong

If a breach affects your data, we tell you by email without undue delay: what happened, which data, and what we are doing. We tell the authorities where the law requires it.

Report a security problem

Write to [email protected] with steps to reproduce the problem. We reply within 7 days and tell you when we have fixed it.

We will not take legal action against you for research in good faith that follows these rules:

Test only your own accounts and workspaces.
Do not read, change or keep anyone else's data. If you encounter it, stop and tell us.
Do not slow down or stop the service.
Give us 90 days after your report before you make the details public.