CRM security and GDPR compliance built into every account

Roles decide which pages a person can open. Ownership-scoped permissions go further, deciding which records they see once they're there - none, only their own, only what they added, both, or all. Condition-based RBAC guardrails enforce the dependencies a permission grid should always have, refusing a save that doesn't make sense rather than silently applying it.

Sign-in supports email/password, Google and Microsoft social login, and two-factor authentication through a TOTP app or email - so a compromised password alone isn't enough to reach an account that has 2FA switched on.

An audit and recent-activity log tracks who did what across the account, so a question about who changed a record has an answer. The same discipline extends to AI-assistant activity through the MCP server: the audit trail records who acted, the token, the action, the record and the field names touched - never the field values.

Public GDPR consent pages let a lead or contact register consent directly, with an administrator able to approve or reject requests - built into the same lead and deal workflow rather than a separate compliance tool.

Database backup and an in-app updater are part of the core platform, so keeping the system current and recoverable isn't left to a customer's own IT team.

When you connect Claude, Cursor, VS Code Copilot or another Model Context Protocol client to CRMLeaf, it calls the API as you, forwarding your own personal access token - so it's bound by the same multi-tenant scoping and permissions you already have, nothing more. The MCP server exposes no delete tools, by design.

For accounts that need a stricter security posture, the CyberSecurity add-on adds email and IP blacklists and login-expiry policies, and the Subdomain add-on gives a tenant its own white-label host.