Security

How workspaces are kept apart

Every customer has its own workspace, and the database enforces that one workspace cannot read or change another's. This is done at the database level, not only in the screens, so it holds however the data is requested. Inside a workspace, Owners and Admins control who is on the team and what role each person has. Some pages, such as the reports and the team list, are limited to Owners and Admins.

Who can see what

• Plans, deal details, buyer notes and reports are internal to your workspace. Buyers have no login and are never sent a link.
• A Rep sees their own plans. Owners and Admins see everyone’s, and only Owners and Admins can open the reports, Rep Synopsis and 1 on 1 prep.

Sign-in and passwords

Sign-in and passwords are handled by our authentication provider, so passwords are not stored in our own tables. People join a workspace through a one-time invitation link that expires.

Payments

Card payments are taken by Stripe on its own secure page. Card numbers never pass through or are stored by Pontem Sales. A workspace is only created after Stripe confirms the payment.

Email and calendar link

When a customer links Microsoft 365, access is read-only and limited to when mail was sent and to whom, whether there was a reply, and calendar events with outside attendees: who was invited, their replies, and the event title and agenda, so a plan can show what each meeting is. Pontem Sales does not read email subjects, message text or attachments, and skips calendar events marked private or confidential. Each person, or a Microsoft 365 administrator, can disconnect it at any time. Google (Gmail and Google Calendar) is built and waiting on Google’s approval. When it is switched on it will work the same way, read-only, and a person who links Google can also remove access from their Google Account settings.

Data in transit and providers

The website and the app are served over HTTPS. We use established providers for hosting and the database (Supabase), payments (Stripe) and email (Resend), and rely on their security controls. Our Privacy Policy lists who they are and what they handle.

Our own access

Access to the administration side of Pontem Sales is limited to Pontem staff who need it. Pontem-wide statistics are built only from anonymised, aggregated data and are produced only when at least three workspaces are included. See the Privacy Policy for details, and how to leave a workspace out.

CRM link

When a customer links a CRM, Pontem Sales reads deals only: deal name, stage, amount, dates, company, buyer contact and deal owner. Nothing is ever written to or changed in the CRM. The access key (or, for Salesforce, the key and secret) the customer provides is stored encrypted, is never shown again, and is used only when an Owner or Admin chooses to pull deals. Only an Owner or Admin of a workspace can link or unlink a CRM. The customer can unlink at any time in Pontem Sales, or delete the key in their CRM, which ends our access immediately.

What we do not claim

We do not currently hold a SOC 2 or ISO 27001 certification. If your organization needs a security questionnaire or a conversation with our team as part of buying, tell us. Enterprise plans include security review support.

Reporting a problem

If you believe you have found a security issue, or that your account may have been compromised, email [email protected] with the subject "Security". Please give us reasonable time to fix a problem before sharing it publicly. We will acknowledge your message and keep you informed.