Security & operations
Security & operations.
Here is where your data lives, how we back it up, what the CRM itself protects – and what it doesn't have yet. We only write down what we have checked.As of 8 Nov 2026 · version 1.1.60
1 · At a glance
| Server location | Hosted: Austria, Vienna data centre (netcup). The server is and stays in Austria. Self-hosted: wherever your server is. |
| Backup | Every night at 03:15: database and files. Every day at 05:00 an extra copy goes to a second, separate location. |
| Restore test | Runs automatically every week. Last run on 6 Nov 2026: no errors, 12 seconds. See the test record |
| Licence | Proprietary software by The-Y e.U., Vienna. Free for up to 3 users · Cloud Pro €20/month per company, all users and brands · self-hosted from €10/month or Lifetime €240 (Alpha & Beta prices). All costs |
| Hosting | Your choice: we host it (Free or Cloud Pro) – or you run the CRM on your own server. It is the same software, and you can take your data with you. |
| Data processing | The hosted CRM is covered by our DPA under Art. 28 GDPR, together with the terms. A signed copy is available on request. |
| Phase | Alpha. What that means for you is under “Honestly”. |
2 · Backups & restore
This applies to the hosted CRM at crm.the-y.at.
- Every night at 03:15 we back up the whole database (compressed) and the file storage with attachments and uploaded files.
- On the server backups are kept for 14 days.
- Every day at 05:00 a second server at a separate location fetches a copy over an encrypted connection. It is kept there for 30 days.
- Every morning at 09:45 a watcher checks: is the newest database backup less than 26 hours old and not suspiciously small? If not, an alarm email goes out.
- Every backup is checked right after it is written: archive intact and completely written. If not, it does not count as a backup and an alarm email goes out.
- Every Sunday at 05:30 we restore the newest backup into a throw-away database as a test – exactly like the test record below. If anything goes wrong, we get an alarm email right away.
- After a deletion data can remain in backup copies for up to 30 days. After that it is overwritten.
Test record · restore test · 6 Nov 2026, 02:23
- The newest backup (5 Nov 2026, 03:15) was restored into a throw-away database with no network. The live system was not touched.
- Restored in one go, without a single error.
- Then version 1.1.57, current at the time, applied its database updates cleanly: 206 of 206 present.
- The file-storage archive unpacked completely.
- The whole test took 12 seconds. We deleted the throw-away copy afterwards.
Self-hosting? You get the same tools.
- backup.sh backs up the database and files. A database backup only counts once it has been checked: archive intact, completely written, not suspiciously small. It only deletes old backups after a valid new one.
- restore.sh restores a backup, restore-files.sh the files.
- restore-test.sh runs a restore test into a throw-away database with no network. Your real database is never changed. Our recommendation: once a week.
3 · How the product protects your data
This is built in – the same hosted and self-hosted unless noted.
| Sign-in | We never store passwords in plain text, only as a hash (scrypt, with its own random value per password). The check always takes the same time – so the response time doesn't reveal whether an account exists. Too many attempts are slowed down: at most 15 sign-ins per minute per IP address, similar for the two-factor code and “forgot password”. Since 1.1.60: after 5 wrong two-factor codes you sign in again, after 10 within 15 minutes the account is briefly locked. After 10 wrong passwords for an address there is a 15-minute pause (sign-in by link still works). |
| Two-factor (2FA) | With an authenticator app (6-digit code). Plus 8 recovery codes: shown once, stored only as a hash, each usable once. Also applies when signing in with an email link or Google. An admin can make 2FA mandatory for the whole account, with a grace period (7 days by default). After that, without 2FA only the setup works – in the app and via the API. “Remember this device” skips the code for 30 days; the password is still required. After a password change, remembered devices no longer count. |
| Sessions | The sign-in cookie only travels over HTTPS and cannot be read by scripts on the page. The database only holds a hash of it. A session ends after 30 days at the latest. Signing out ends all sessions in that browser. Changing or resetting the password ends the other sessions. Under “My profile” you see your signed-in devices and sign out single ones or all others; an admin can sign a person out everywhere (since 1.1.60). |
| Roles & permissions | Three standard roles for the team: Admin, Team lead and Agent – plus custom roles, e.g. “Front desk” (since 1.1.60). Permissions exist per area, with the reach “own”, “team” or “all” – for example, an agent only sees their own contacts and deals. You can grant or remove permissions for individual people; “remove” wins. Nobody can give permissions they don't have themselves. The server checks the permissions, not just the interface. |
| Accounts kept apart | Each account is separated from the others in the database itself (row-level security). The app works with a database role without special privileges. The database enforces this, not just the program code. |
| Stored credentials | Mailbox passwords, access keys for WhatsApp, Facebook and Instagram, SMS providers and Microsoft, your AI key, telephony passwords and the 2FA secret are stored encrypted (AES-256-GCM). The export (snapshot) contains no secrets. |
| Security log | It records: sign-ins (including failed ones, with IP address), changes to 2FA, roles and team, account resets and deletions, support access. Nobody can change or delete entries – the database itself blocks that. Entries are kept for at least 365 days, even if you reset the account. Admins find it under Settings → Change log, since 1.1.60 with search, filters and CSV export. |
| Support access hosted only | Our support only gets into your account in the app if an admin on your side creates a service PIN: 6 digits, valid for 24 hours, revocable at any time. After 5 wrong PINs there is a 15-minute pause. In an emergency, access without a PIN needs a written reason, lasts at most 60 minutes – and all admins get an email straight away. Every access is in the security log. |
| Connection | The CRM runs over HTTPS. Anyone opening http:// is redirected to https://. The browser receives strict security rules, for example the app may not be embedded in other sites. Messages that Meta sends to the CRM are checked for their signature. |
| Export & deletion | Admins export contacts, companies, deals, tasks, conversations and AI suggestions as CSV – or the whole account as a snapshot, for example to move to your own server. You can delete individual people permanently. You can reset the whole account; the person who created it can delete it (if Cloud Pro is running, cancel it first). How data deletion works |
4 · Updates
We ship updates often and document every version openly in the release notes – with a separate “For self-hosters” section. From 22 Oct to 8 Nov 2026 there were eleven versions:
| Date | Version | What it was about |
|---|---|---|
| 8 Nov 2026 | 1.1.60 | Custom roles, change log with search, signed-in devices, API keys with permissions and expiry, signed webhooks and fixes from our own security test |
| 8 Nov 2026 | 1.1.59.1 | Security fix in the phone system: dialled numbers only as digits |
| 8 Nov 2026 | 1.1.59 | Consistent amounts and dates in the English interface, test environment in the language of the demo, self-hosting without a domain on your home network |
| 6 Nov 2026 | 1.1.58 | Your camera while sharing, online booking “from tomorrow”, email with Cc, Bcc and forwarding, campaigns count only if you want to |
| 5 Nov 2026 | 1.1.57 | Sign in with an email link or Google, sign up without a password, better readability |
| 5 Nov 2026 | 1.1.56 | Demo starts in a conversation, emails to customers only via your mailbox |
| 1 Nov 2026 | 1.1.55 | Maintenance update |
| 27 Oct 2026 | 1.1.54 | Screen sharing in video meetings, several time windows for booking links |
| 25 Oct 2026 | 1.1.53.1 | Two-factor requirement applies everywhere |
| 25 Oct 2026 | 1.1.53 | Tidier, built for teams, one set of opening hours for everything |
| 22 Oct 2026 | 1.1.52 | Queue with position and callback, phone rings along, brand builder |
- Hosted: we install updates. You don't need to do anything.
- Self-hosted:
update.shbacks up before the update (if the backup service is set up), checks afterwards that everything runs, and otherwise rolls back to the previous version on its own. With--probeyou see beforehand what would happen. The Lifetime licence includes updates and security fixes for as long as they are offered.
5 · Licence & hosting at a glance
| Hosted: Free or Cloud Pro | Self-hosted: free key, Founder or Lifetime | |
|---|---|---|
| Price | Free €0 (up to 3 users). Cloud Pro €20/month per company, all users and brands (Alpha & Beta; €40/month from the Live release). | Free with a free key €0 (up to 3 users, no support). Founder €10/month, Lifetime €240 one-off (Alpha & Beta; from the Live release €20/month or €480). You pay for the server yourself. |
| Where the data lives | crm.the-y.at, servers in Austria (Vienna data centre). | On your server. You decide where it is. |
| Backups | We do them (see section 2). You can also export yourself at any time. | You do them, with backup.sh, restore.sh and restore-test.sh. |
| Updates | We install them. | You, with update.sh – automatically at night if you like. |
| Who has access | Your team, according to their role. The-Y e.U. runs the server; we only access it as far as operations require. Our support only gets into your account in the app with your service PIN or via the logged emergency route. The data centre is provided by netcup. | You and your team. The-Y does not run your server and is only the software supplier there. Your installation checks its licence with us about once an hour; this sends us the licence key, an installation ID and the version number. |
| Emails | System emails (e.g. sign-in links, password resets, invitations) go through the EU data centre (Amsterdam) of the delivery service SMTP2GO. Emails to your customers only go through your own mailbox. | Your installation sends its emails itself. |
| Contract | DPA under Art. 28 GDPR. | No DPA with us needed – we are not a processor there. |
What else goes where
- AI (optional): content only goes to the provider whose key you enter (Anthropic, OpenAI or Google). Without a key, AI stays off.
- Translation in the inbox: by default on our own translation service in the Vienna data centre. It has no access to the internet.
- Our own company email (e.g. office@the-y.at) is on our mail server with RackNerd in the USA. The CRM and your customers' data do not pass through it. Details in the privacy policy.
6 · Report a vulnerability
Found a weakness in The-Y CRM or on the-y.at? Thank you for reporting it.
- Write to office@the-y.at, subject “Security”. German or English is fine.
- Briefly describe what you found and how to reproduce it.
- Don't send real customer data, passwords or access keys. Our company email is on a mail server in the USA (see above).
- Only test with your own account. Don't access other people's data and don't disrupt the service.
- Don't publish anything before we have been able to close the gap. We will get back to you.
Machine-readable: /.well-known/security.txt (per RFC 9116).
If we learn of a breach affecting your data, we notify you without undue delay (DPA, section 8).
7 · Honestly: what we don't have (yet)
- No certification. The-Y CRM has no certification – no ISO 27001, no SOC 2. What we do is on this page and in the DPA (Annex 1).
- No bug bounty. We don't pay rewards for reported vulnerabilities.
- Alpha. Backups run, but still without a formal guarantee (best effort). There is no guaranteed availability (no SLA). In the Alpha, don't use the CRM as the only place for business-critical data, and export regularly.
- With the Beta the DPA (Annex 3) adds fixed targets: in the worst case at most 24 hours of data loss and at most 48 hours until everything runs again. These are targets too, not yet an SLA. The restore test the DPA requires monthly from the Beta already runs every week.
- 2FA is still optional – unless your admin switches it on for everyone. From the Beta it becomes mandatory for admins (DPA, Annex 1).
- Our company email still runs via the USA. The mail server for addresses like office@the-y.at is with RackNerd. This does not affect the CRM. We are looking into moving it to the EU.
Outages are shown on the status page, known bugs and their fixes under Known Issues.