Security and trust
Your CRM holds your relationships, so we've built it to keep them private, to change only what you approve, and to let you leave with your data whenever you want.
Protecting data
- Encrypted in transit: every connection uses HTTPS/TLS, including to the database.
- Passwords are never stored. We keep a salted scrypt hash.
- Mailbox credentials you connect are encrypted at rest with AES-256-GCM.
- Payments go through Razorpay (PCI DSS compliant). We never see or store full card numbers.
- Sign-in cookie is HTTP-only, so page scripts can't read it.
Keeping customers apart
- Every query is scoped to your workspace in code, so one customer's data can't be reached from another's account.
- Within a workspace, records can be private to the person who created them.
- Scanned business cards are read on our servers and the photo isn't stored.
AI you stay in control of
- Shelly can't change your CRM by itself. Every add, edit or delete is shown as a card and happens only when you press Yes. Deletes are flagged in red and say plainly that they can't be undone.
- Each specialist inside Shelly can reach only the tools its job needs.
- Your data isn't used to train AI models.
Your data, your control
- Export any board to CSV at any time.
- Delete your account and workspace yourself from Settings → General.
- Archived records can be restored, and permanent deletes always ask for confirmation.
Reporting a vulnerability
If you think you've found a security issue, email hello@celestris.pro with the details. Please give us a reasonable time to fix it before disclosing it. We won't take action against good-faith research that respects our users' privacy.