Category

Data, privacy and security

Control GDPR, consent, exports, backups, audit logs, authentication and data retention.

01Configure GDPR and consent purposesDefine consent purposes and enable the privacy tools required by the organisation.02Record and review contact consentCapture opt-in or opt-out evidence for configured consent purposes.03Handle a data removal requestReview the request, assess linked records and update status using the organisation’s legal process.04Export CRM dataGenerate supported data exports for portability, audit or controlled analysis.05Create and restore database backups safelyCreate, download, schedule and retain database backups according to an approved recovery policy.06Review the activity logAudit important staff and system actions and clear logs only under an approved retention policy.07Configure password, session and two-factor securityApply strong authentication practices and understand session-clearing controls.08Manage spam filters and blocked sendersReduce unwanted support traffic while avoiding over-broad rules that block valid customers.

Related HR governance guides

Related Compliance Monitor guides

Core CRM security hardening update

The release adds the following core protections and matched migration guidance. Existing Data Privacy & Security guides remain unchanged.

01Core CRM security hardening release overviewUnderstand the complete security overlay, matched migrations and operational checks included in the core CRM update.02Use cryptographically secure public tokensUnderstand how public links and tokenised actions use secure unpredictable token generation.03Understand Argon2id password hashingUnderstand the one-way password algorithm applied to newly created or changed credentials.04Understand transparent phpass password upgrading after loginUnderstand how a valid legacy phpass password is re-hashed after successful authentication.05Apply staff login throttlingUnderstand protection against repeated failed staff authentication attempts.06Apply client login throttlingUnderstand protection against repeated failed client-portal authentication attempts.07Apply API request throttlingUnderstand rate controls protecting authenticated and token-based API traffic.08Apply two-factor authentication throttlingUnderstand rate controls protecting repeated 2FA-code submissions.09Use secure HttpOnly and SameSite cookie defaultsUnderstand the hardened defaults applied to authentication and session cookies.10Understand session regeneration improvementsUnderstand improved session-identifier replacement around authentication and security-sensitive state changes.11Verify the corrected two-factor assignment flowConfirm that 2FA setup and assignment apply to the intended account.12Understand restricted CSRF exclusionsUnderstand why only explicitly required endpoints may bypass CSRF checks.13Understand one-way SaaS API-token storageUnderstand why SaaS API tokens are stored as non-recoverable server-side representations.14Manage API-token expiry, revocation, rotation and usage metadataUse the complete API-token lifecycle added by the security release.15Configure trusted reverse-proxy handling safelyAllow forwarded connection information only from approved proxy addresses.16Enforce production TLS certificate verificationUnderstand mandatory certificate and hostname verification for production outbound connections.17Review security headers and CSP report-only modeReview response security headers and the initial Content Security Policy reporting mode.18Use central security audit loggingUse the consolidated event trail for security-sensitive activity.19Apply upload and installer web-server protectionsProtect uploaded content and installer locations from direct execution or unsafe public access.20Apply Core migration 342Apply the core database component required by the hardening release.21Apply Britixo SaaS migration 040Apply the SaaS database component required by token and tenant hardening.22Verify the updated future-tenant database seedConfirm newly provisioned SaaS tenants receive the hardened baseline.23Confirm removal of unnecessary runtime development artefactsVerify that development-only material is absent from the production runtime overlay.24Run the post-upgrade security verification checklistVerify every included hardening item before closing the release change.25Troubleshoot a core security hardening deploymentDiagnose security-release failures without disabling the new controls.