Customer trust starts with careful access.

Account access

Reo requires a verified identity and active workspace membership. Authentication credentials are not exposed to the application’s browser code, and protected changes require same-origin, session-bound request checks.

Workspace Owners control membership and seller assignments. Changes that affect access and CRM history are recorded in append-only audit history.

Workspace separation

Hosted records belong to a specific workspace. Application checks and database row-level security both restrict access so a member can reach only records for an active workspace membership.

The public landing page does not receive CRM records. Its product images contain invented companies and contacts.

Backup and recovery

Scheduled backups store encrypted recovery copies off-site. Restore procedures are tested in isolated environments, including record, identity, membership, and migration checks.

Recovery testing reduces risk, but it is not a promise of uninterrupted service or zero data loss.

Document safeguards

Document uploads are available on Accounts and Opportunities. Active workspace members can list and download ready documents. Upload, rename, and removal require the account’s current responsible salesperson or an Owner, subject to workspace access and billing permissions, with access checked again for each action. Renaming changes metadata only; it does not replace the stored file contents.

Supported formats are subject to filename, type, size, stored-byte, and checksum validation, with limits of 25 MiB per file and 250 MiB per workspace. Downloads are delivered as attachments rather than displayed inline. Reo does not perform malware scanning; file validation does not establish that a file is harmless.

Removal hides the file while durable cleanup proceeds. Encrypted recovery copies may remain under the 90-day recovery retention policy, starting when a copy is retired from active recovery storage rather than necessarily when you remove it. Processing delays can extend the time after removal; no fixed removal-to-erasure deadline or immediate permanent erasure is promised. Document metadata and audit history remain.

What this page means

This page describes the safeguards used by the service. It is not a certification, security warranty, or promise that incidents can never occur.

A public security-reporting address and formal vulnerability-disclosure process will be published before account access opens broadly.