Security & privacy you can rely on
We've supported organizations with software and managed services since 2017. Here's how we protect your data and keep our services dependable - in plain language.
Where your data lives
Customer sites and applications run on Google Cloud (Compute Engine, region us-central1, United States), managed with the Plesk control panel. CCMS runs its own DNS. Customer production data is not used in development or testing.
Encryption
All traffic is served over HTTPS (TLS) with certificates managed automatically. Designated sensitive secrets, such as keys and tokens that customers connect, are encrypted in the application using libsodium authenticated encryption. We do not claim that all stored data is encrypted in the application.
Payment security
Payments are processed by Stripe, a PCI-DSS Level 1 certified provider. We never see or store full card numbers - card data goes directly to Stripe.
Account protection
Passwords are stored only as salted hashes. Customers can turn on two-factor authentication (an authenticator app) with recovery codes in their account portal, and sign-in attempts are rate-limited.
Accountability & logging
Administrative actions in our admin system are recorded in an audit log. Server and administrative logs are kept for 90 days.
Who can reach your systems
Access is limited to a small number of authorized CCMS personnel. Everyone uses their own named account, and shared logins are not allowed. Two-factor authentication is required for administrator access to our hosting control panel, cloud account, other business systems and our own admin system. When someone leaves or changes role, their access is removed or reduced the same day.
Backups & updates
A nightly incremental backup runs at 1:00 a.m. Eastern and a full backup runs monthly and is kept for two months. Backups are password protected and stored on the server and on Google Drive. We test a restore at least once a year. Operating system and control panel security updates are applied automatically, and the server is restarted only when an update requires it.
If something goes wrong
We have a written incident response process. If we determine, or have reason to believe, that a security incident affected your data, we will notify you in writing without undue delay and within 72 hours, and keep you updated.
Your data
You can ask us for a copy of your data or for its deletion at any time. We handle requests as described in our Privacy Policy and your agreement. Write to privacy@ccmssolutions.com.
Reliability & transparency
Service health is published on our status page, where you can subscribe to incident and maintenance notifications.
What we do not claim
CCMS does not currently hold a SOC 2 or ISO 27001 report; we rely on Google Cloud's independent audits for its data centers, and a SOC 2 report is a long-term goal, not something we have today. CCMS does not offer HIPAA compliance or sign Business Associate Agreements, so please do not store protected health information with us. We do not guarantee that a service will never be interrupted.
Subprocessors
We work with a small set of trusted providers to deliver our services. Each is selected for its security posture and bound by data-protection terms. A payment processor, calendar or text-message provider (such as SignalWire) that a customer connects for its own use is that customer's own vendor. Our security.txt lists our security contact. Last reviewed October 25, 2026.
| Provider | Purpose | Privacy |
|---|---|---|
| Google Cloud | Hosting and infrastructure (Compute Engine, us-central1, United States) | Policy |
| Google Drive | Copies of password-protected backups | Policy |
| Stripe | Payment processing & billing for CCMS sales | Policy |
| SendGrid | System and application email | Policy |
| Cloudflare Turnstile | Bot protection on forms | Policy |
| WorkOS | Authentication / SSO for connector products | Policy |
| GoHighLevel | CCMS's own sales and support lead handling | Policy |
| OpenAI | Website chat assistant (messages typed into the chat) | Policy |
Have a security or compliance questionnaire? Contact our team - we're based in Fort Lauderdale, Florida, with U.S.-based support.