Skip to main content

​
Authentication and access control

  • Sign-in is handled through Auth0, an industry-standard identity provider, rather than Poodle AI storing plaintext credentials directly.
  • Access to an organization’s data is scoped by role: Rep, Admin, and Super Admin, each with progressively broader permissions (for example, only Admins can connect a CRM, change company settings, or manage billing).
  • New members join an organization only through an admin-issued invitation or an approved sign-up flow — there is no open self-serve join into an existing organization’s data.

​
Encryption

  • CRM integration credentials (OAuth access and refresh tokens for Salesforce, HubSpot, Zoho CRM, Outreach, and Gong) are encrypted before they are stored, using authenticated symmetric encryption with a dedicated encryption key. They are decrypted only in memory, at the moment they’re needed to call the provider’s API.
  • Product traffic is served over HTTPS/TLS.
  • Uploaded files and session recordings are stored in Amazon S3 and accessed only through short-lived, pre-signed URLs rather than public links.

​
Infrastructure

  • Poodle AI is hosted on Amazon Web Services (AWS), using a managed PostgreSQL database and S3 for file and recording storage.
  • Live practice sessions run on LiveKit’s real-time media infrastructure.
  • CRM synchronization jobs run as isolated AWS Lambda functions rather than inside the main application.

​
Monitoring and audit logging

  • Every CRM connection event (connect, disconnect, consent grant/revoke, data access, data deletion) is written to an access log with a success or failure status, scoped to the organization.
  • Changes to a user’s privacy consent preferences are written to a separate audit log, capturing the previous and new state, how consent was collected, and a hashed IP address — accessible only to Super Admins for compliance review.
  • Per-provider rate limiting is enforced on CRM API calls to prevent abuse and protect connected third-party systems.
Details governed by internal policy rather than product configuration — including penetration testing cadence, vulnerability management SLAs, and personnel security training — are available on request from your account team.

Next: your data privacy rights

How consent, data export, and deletion work.