Security
Your database is your business. Here’s how we treat it.
An agent’s contact database is often their single most valuable asset. This page says plainly what My Roost CRM does to protect it — and, in the same honest voice as the rest of this site, what we don’t have yet.
In transit
- All traffic is HTTPS with HSTS, covering every subdomain — the browser refuses to talk to Roost over an unencrypted connection.
- A Content-Security-Policy blocks scripts from foreign origins, plugins, base-tag hijacking, and form posts to other sites. String-eval is off: eval() and new Function() are blocked (WebAssembly compilation is the one narrow exception, for in-browser video background effects).
- That policy is deliberately not a maximum-strictness one: it still allows inline scripts, because the app's pre-paint theme script and the structured-data blocks search engines read are inline. We'd rather say so than call it strict.
- Session cookies are Secure, HttpOnly, and SameSite — never readable by page JavaScript.
Tenant isolation
- Every record in Roost belongs to exactly one workspace (org), enforced by row-level security at the database layer — not just application code.
- Your agents see their own and shared records; owners see everything in the workspace, and nothing outside it.
- The public live demo runs in its own isolated workspace and is server-side read-only — demo visitors can't change data or send anything real.
Access controls
- Per-seat controls: an owner can restrict whole app areas for an agent seat, or deactivate a seat — the lockout takes effect on that seat's very next request.
- The founder/admin console is gated server-side on every page and every action, not just hidden in the menu.
- Plans don't lock features — every plan reaches every tool. What differs is the monthly allowance (AI images, voice minutes, cards, valuation lookups), and those meters are counted server-side against your workspace's plan in the database, never from anything your browser can set.
Your data, your exit
- Export your contacts to CSV anytime, from inside the app.
- Cancel anytime — no lock-in, no exit fees.
- We don't sell your data, ever. Your mobile and contact information is never shared with third parties for their marketing.
- Daily database backups.
Payments
- Billing runs through Stripe. Card numbers are entered on Stripe's systems and never touch Roost's servers.
What we don’t have yet (honesty section)
We’re an early-stage product and won’t pretend otherwise: there’s no SOC 2 report yet, no formal uptime SLA, and no compliance badges on this page that we didn’t earn. If your brokerage has specific security requirements, ask us directly— you’ll get a straight answer about what we do today, not a whitepaper written by marketing.
See it for yourself
The live demo runs in an isolated, read-only workspace — poke at everything.