Security at SOAR

Last updated August 24, 2026

This page is written for the person at your company who has to sign off on letting SOAR touch your data. It describes what the system actually does, and it is equally clear about what we do not have.

If you need something more formal — a completed security questionnaire, a walk-through with whoever wrote the code — email hello@soar-crm.com and ask.

What we do not have

Putting this first, because every vendor page buries it.

• No SOC 2 report. Not Type I, not Type II.
• No ISO 27001 certification.
• No Cyber Essentials certification.
• No third-party penetration test report.

We run our own adversarial test suite against the application, described below. That is our own work testing our own code, and it is not independent assurance. It is useful to us and it is honest to show it to you, but it is not a pentest report and we will never describe it as one.

If a third-party report is a hard requirement for your procurement process, say so early. We would rather tell you where we are than have you find out three weeks into a purchase.

Why none of this is claimed anywhere else on our site: a security claim you cannot evidence is worse than a gap you disclosed. Overstating security in a published policy is an unfair-or-deceptive practice under Section 5 of the FTC Act, and it is enforced.

What we do have

Every item here corresponds to something in the running system.

Getting in

• Multi-factor authentication is mandatory. It is not a setting a user can turn off, and there is no path into the product that skips it.
• Passwords are hashed with bcrypt, never stored reversibly, never logged.
• Sessions expire after 24 hours, can be revoked one at a time, and can be killed everywhere at once.
• Repeated failed sign-ins lock the account.

Keeping tenants apart

• Every database query is scoped to the organisation that owns the record.
• This is the failure that would matter most, so it is the one with the most tests: forged tokens, altered role claims, cross-organisation identifiers and escalated staff flags are all covered, and every one of them is expected to fail closed.

Data in transit and at rest

• API traffic is served over HTTPS.
• Connector credentials and OAuth tokens are encrypted at rest and are never returned by the API, not even to the account that set them.
• Automated database backups, plus a 90-day recoverable hold on anything deleted — so a mistake made on a Friday is still fixable on Monday.

The application itself

• Content Security Policy and security headers on the application surfaces.
• SSRF protection on outbound connections: a configured mail host cannot be pointed at internal infrastructure or a cloud metadata endpoint.
• The desktop app runs sandboxed, with context isolation on, Node integration off, and in-app navigation and embedded frames blocked.
• The interface is React with no raw HTML injection, and AI output is rendered as text, never as markup.

Who at SOAR can see your workspace

Stated plainly because you should not find it out later:

SOAR staff can open your workspace as an administrator in order to configure, train and support your agents. That access is time-limited, requires a written reason, and every action is logged. Those logs are kept for three years — deliberately longer than anything else we retain, because an audit trail that expires before the audit is not an audit.

We will show you your own access log on request.

Artificial intelligence

• Anthropic is the only AI provider that receives your data. Not OpenAI, not Google. The full list is at Subprocessors.
• Under our commercial terms, your content is not used to train models.
• Inbound content — mail, uploads, chat — is treated as untrusted input to a system that can take actions, and model output is never trusted as a record without validation.
• AI work is held for human approval by default. Releasing a category of work to run unattended is your decision, it is recorded, and it is reversible.

Before each release

An adversarial test suite runs against a local instance on a test database — never production. It covers authentication bypasses, tenant isolation, injection and payload handling. A failure there is treated as a security regression that blocks the release, not as a broken test to be skipped.

Known gaps we are working on

Listed because you will find them anyway, and because a vendor who tells you first is the one worth trusting.

• The marketing site does not yet enforce HTTPS or send security headers. It is served by GitHub Pages, which cannot set headers. This matters more than it sounds, because that host also serves the invitation, password-reset and welcome pages. The fix is a CDN in front of it, and it is queued.
• We hold no third-party certification. Covered above. The intended order is Cyber Essentials, then an independent penetration test, then SOC 2.
• DNS rebinding on connector hosts is not fully closed. The SSRF guard validates the host; the underlying mail library does not let us pin the resolved address.

Reporting a vulnerability

Email hello@soar-crm.com. Tell us what you found and how to reproduce it.

We will acknowledge within two business days and keep you updated until it is resolved. We will not pursue good-faith research that stops at proof and does not access, alter or exfiltrate anyone else's data. We do not currently pay a bounty, and we will credit you if you would like us to.

Please do not run scans or penetration tests against the service without asking first — see §4 of the Acceptable Use Policy. Ask; the answer is usually yes, in a scheduled window.

Related

• Privacy Notice — the SOAR application
• Data Processing Addendum — Annex II lists the measures in contract form
• Subprocessors

SOAR CRM LLC · 100 Holly Park Court, Holly Springs, GA 30115 · hello@soar-crm.com