Security
A firm’s pipeline, client relationships and pursuit strategy are among its most confidential records. This page describes the controls that protect them in New Dynamics, specifically and without badges.
Every record carries your firm's workspace identity. Queries are scoped to that workspace on every request, and single-record lookups reject cross-tenant access outright.
Why it mattersYour client list and pipeline are visible to your firm and no one else, enforced in the data layer, not by convention.
Six roles, from owner to read-only viewer, enforced in middleware. Administrative areas require explicit role checks, and the last owner of a workspace cannot be removed by accident.
Why it mattersA trainee can read the account plan without being able to delete it; billing and member management stay with the people accountable for them.
Passwords are hashed with salted PBKDF2 (100,000 iterations) and compared in constant time. Sessions are signed and expire. Google sign-in is available when your firm enables it.
Why it mattersCredential handling follows current published guidance rather than convenience.
Sign-ins, invitations, role changes, imports, exports and settings changes are recorded per workspace with actor and timestamp.
Why it mattersWhen someone asks who exported the pipeline in March, there is an answer.
The application is served over HTTPS only. Secrets live in the deployment environment, never in the codebase.
Why it mattersData in transit between your team and the platform is encrypted as standard.
Excel import is validated row by row before anything is written. Export is available to authorised roles and recorded in the audit log.
Why it mattersYour data is yours to take with you, and its movement is visible to your administrators.
Workspace invitations are single-use tokens bound to the invited email address. OAuth flows carry anti-forgery state tokens.
Why it mattersJoining a workspace requires being invited to it, not guessing a link.
New Dynamics processes the business contact information your firm chooses to record, names, roles, organisations and interaction notes. Your firm remains the controller of that data; access is limited to your workspace members, its movement is auditable, and it can be exported or deleted on request.
Hosting arrangements, data residency, backup and retention schedules, and subprocessors are documented and shared during procurement. Ask for the current security summary when you book a demonstration, we would rather answer precisely than print a badge.
Procurement, IT and risk colleagues are welcome. We will walk through access control, audit history and data handling on the live product.