Security Statement

Scope

This statement covers Salesfloor CRM, the sales platform operated by Universal Media, and the customer data it holds, including data accessed through connected third-party services.

Protecting your data

• Data is encrypted in transit and at rest by our hosting and database providers.
• Access requires an account and is restricted by workspace, role and permission, so each workspace only reaches its own records.
• Credentials and integration tokens are encrypted and stored where application users cannot read them.
• Administrative and integration activity is recorded in audit trails that application users cannot edit or delete.
• Access is reviewed periodically and removed when no longer required.

Connected services

Integrations are requested with the narrowest scope that makes the feature work. Our QuickBooks Online integration is read-only: it reads bill and income summaries for reporting and cannot create or modify any accounting record. Connections are authorised by a workspace administrator and can be disconnected at any time, which revokes our access and deletes the stored tokens.

Salesfloor CRM includes generative-AI features. Accounting data retrieved from QuickBooks Online is not sent to any AI provider.

Incident response

We maintain a written, approved internal incident-response policy with a named owner, defined severity levels and target response times, containment and credential revocation steps, evidence preservation, and a post-incident review. Its operational detail is kept internal.

Following confirmation of a reportable security incident, the Incident Response Owner will assess and initiate required notifications without unreasonable delay and within all applicable legal, regulatory, contractual and platform-required deadlines. Where multiple deadlines apply, the shortest applicable deadline governs. Affected customers are notified where required, and platform partners are notified through their required security-incident channels within the timeframes their current terms specify.

Review and monitoring

We run automated dependency and configuration security scans, review this statement and the underlying policy at least annually and after any significant incident, and exercise the response plan on a recurring basis. We do not currently claim any third-party security certification or independent audit.

Reporting a concern

Report a suspected vulnerability or security incident to info@universalmediaus.com. Please include enough detail to reproduce the issue and do not include credentials or other people's personal data. Reports are triaged by our security contact.