This Phase 3 starter adds password hashing, HTTP-only sessions and workspace-isolated databases. Production deployment still requires HTTPS, managed backups, email verification, password recovery, monitoring and a reviewed data-retention policy.
Each newly created organization receives a separate CRM database in this starter architecture.
CRM, lead, call, compliance and backup endpoints require an authenticated session.
Passwords are salted and hashed server-side; session cookies are HTTP-only and configured Secure in production mode.
No SOC 2, HIPAA, PCI or other certification claim is made by this starter.