Security & Trust at Juicy Goosey
Juicy Goosey CRM stores your customer data with industry-standard encryption, role-based access controls and audited operational practices. AI features run with strict no-training guarantees from our model providers. This page documents our certifications, sub-processors, data handling, AI privacy and how to report a vulnerability.
You should not have to email sales to find out how we handle your customer data. If something is missing, contact security@juicygooseycrm.com and we will add it.
Quick Reference For IT Reviewers
| Topic | Status |
|---|---|
| SOC 2 Type II (our company) | Not certified. Hosted on SOC 2 Type II certified infrastructure (AWS). Our own attestation is on the roadmap, no committed date. |
| GDPR Compliant | Yes. Standard DPA available on request. |
| CCPA / CPRA Compliant | Yes. |
| HIPAA + BAA | NOT available. If you handle PHI, Juicy Goosey is not a current fit. |
| ISO 27001 | Roadmap. No committed date. |
| Encryption at rest | AES-256 |
| Encryption in transit | TLS 1.2+ |
| MFA | Available. Enforced for admins. |
| SSO (SAML / OIDC) | Available on team plans. |
| DPA available | Yes, signed on request. |
| Vulnerability disclosure | security@juicygooseycrm.com |
| AI: trains on your data | NO |
| Data residency | US only |
Data Handling
Where Your Data Lives
- Primary: AWS us-east-1 (US only)
- Backups: encrypted, retained 30 days
- Logs: 90-day rolling
- No EU or AU data residency options today
What We Collect
- Account info, CRM contacts/deals you input
- Integration metadata
- Usage telemetry (page-load, errors, feature use)
- No content keystrokes, no inbox scraping
How Long We Keep It
- Active account: as long as you use it
- Closed account: 30-day grace, then permanent delete
- 7-year retention available for legal holds
Data Export
- One-click full export to CSV at any time
- No support ticket required
- Works on active, paused and cancelling accounts
Encryption
At Rest
AES-256 on all stored data, including backups.
In Transit
TLS 1.2 minimum, TLS 1.3 preferred.
Key Management
AWS KMS. Customer-managed keys available on enterprise.
Access Controls
Authentication
- Email + password by default
- MFA optional for users, enforced for admins
- SSO via SAML or OIDC on team plans
Authorization
- Role-based access control (Admin, Manager, Member, Read-only)
- Per-pipeline and per-segment permissions on team plans
- Audit log of every access and change
Session Management
- Configurable timeout
- Active session list and revocation per user
AI Privacy
We Do Not Train On Your Data
Contractually enforced with our model providers (OpenAI, Anthropic, Google). Verified via their API enterprise terms. Your data is used only to generate the output you requested, then discarded.
Where AI Calls Go
Native: through our enterprise contracts with the model providers. No training, 30-day retention max. BYOK: through your own model provider account, your terms apply.
What AI Sees
Only the data you explicitly route to it (the contact, the deal, the thread you ask about). Never the full database. Scoped per-request, not bulk access.
Audit Trail and Opt Out
Every AI call logged with prompt summary, model, output and effect. You can disable any AI feature globally, per workflow or per user.
Sub-Processors
| Sub-Processor | Purpose | Data | Region |
|---|---|---|---|
| AWS | Hosting | All customer data | US |
| Stripe | Payment processing | Billing only | US |
| OpenAI | AI features (default) | Per-call only, no training | US |
| Anthropic | AI features (Claude) | Per-call only, no training | US |
| AI features (Gemini) | Per-call only, no training | US | |
| Postmark | Transactional email | Email + metadata | US |
| Sentry | Error monitoring | Stack traces, no PII | US |
| Cloudflare | DDoS / CDN | Edge requests | Global |
We notify customers 30 days before adding a new sub-processor. List updated April 2026.
Certifications
SOC 2 Type II (Juicy Goosey itself): Not yet certified. Hosted on SOC 2 Type II certified infrastructure (AWS). Our own attestation is on the compliance roadmap. No committed date yet.
GDPR: Compliant. DPA available on request.
CCPA / CPRA: Compliant.
HIPAA: BAA NOT currently available. If you handle PHI, Juicy Goosey is not the right fit today. Look at Salesforce Health Cloud, HubSpot HIPAA add-on or vertical health-focused CRMs.
ISO 27001: On roadmap. No committed date.
We will not claim certifications we do not have.
Vulnerability Disclosure
- Email: security@juicygooseycrm.com
- We promise: acknowledge within 48 hours, status updates every 7 days, fix or risk-accept decision within 30 days
- No legal threats for good-faith security research
Incident Response
- Within 24 hours: we tell affected customers
- Within 72 hours: we file with relevant regulators (GDPR 72-hour rule, US state breach notifications)
- Public status: status.juicygooseycrm.com
- Post-mortem: within 30 days of resolution, public for any incident affecting more than 1% of customers
Compliance Documents Available On Request
- Data Processing Agreement (DPA)
- GDPR-aligned Data Processing Addendum
- Standard Contractual Clauses (SCCs) for international transfers
- Penetration test summary letter (most recent)
- AWS SOC 2 Type II report (infrastructure provider)
Email security@juicygooseycrm.com to request.