Your CRM data, handled carefully
NitroDialer connects to the systems that hold your customers. Here's how that access is protected.
Encrypted credentials
Dialpad and CRM OAuth tokens are encrypted with AES-256-GCM before they're stored. API keys are stored only as SHA-256 hashes, so a key is shown once and can't be read back.
Workspace isolation
Every row of customer data carries its workspace, and database row-level security limits what a signed-in browser can read to its own workspace. Writes go through the server, which checks the user's role first.
Signed webhooks, both ways
Incoming Dialpad call events must carry a valid HS256 signature or they're rejected. Outgoing NitroDialer webhooks are signed with HMAC-SHA256 and a timestamp so you can verify them and reject replays.
Least privilege
NitroDialer asks only for the OAuth scopes it uses: reading the records you dial and writing notes, status and call activity. Roles limit what each person can do: agents dial, managers run campaigns and coaching, admins manage connections and keys.
Sign in with Dialpad
People sign in with their Dialpad account, so access follows your Dialpad user management. Deactivating someone in NitroDialer stops their access immediately.
Audit trail
Admin actions such as connecting a CRM, creating API keys and changing campaigns are recorded in the workspace audit log. Every call also stores its compliance evidence.
Found a security issue? Email hello@nitrodialer.com and we'll respond promptly.
Need a security review?
Enterprise customers can request our security questionnaire answers and a data processing agreement.