VisaPilot CRM is built with security as a core requirement, not an afterthought. Immigration data is sensitive — we treat it that way.
1. Security Overview
Every immigration firm on VisaPilot CRM operates in a completely isolated multi-tenant environment. Row-level data isolation, enforced by a global scope on all queries, ensures one firm can never access another firm's data — even from the same database.
Our platform processes sensitive immigration data including passports, financial records, and personal identification. We apply strong, layered security controls throughout.
2. Encryption
In Transit
- All connections to VisaPilot CRM are encrypted with TLS 1.2+
- HTTPS is enforced — HTTP requests are automatically redirected
- HSTS headers prevent downgrade attacks
At Rest
- Sensitive credentials (connected email passwords, calendar tokens) encrypted with AES-256
- Client documents are never served by direct link — only to signed-in users of the firm, through access-checked downloads
- Passwords hashed with bcrypt (never stored in plain text)
- Payment data is tokenized by Stripe — we never store raw card numbers
3. Access Controls
VisaPilot CRM enforces strict role-based access control (RBAC) with four distinct roles:
| Role | Access Level | Data Scope |
|---|---|---|
| Admin | Full firm access | All branches, all applications, full team management |
| Sale Agent | Branch-scoped access | Only their assigned branch's applications and clients |
| Client | Portal access only | Only their own visa applications and documents |
| Platform Owner (Superadmin) | Platform management | Firm accounts only — cannot access application data |
By design, the Platform Owner (Tech Vanta LLC superadmin) cannot access your firm's visa application data or client records. The platform admin panel has no way to sign in to a firm's account or open its clients, applications or documents — it only shows firm-level details such as plan, billing and team members.
4. Two-Factor Authentication (2FA)
VisaPilot CRM supports two methods of two-factor authentication:
- Email OTP — A one-time code sent to your registered email address on login (optional; sent only after you turn it on in Profile → Security)
- Google Authenticator / TOTP — Time-based one-time passwords via authenticator app (Growth and Agency plans)
Admins can enforce 2FA as mandatory for all team members from the Security settings panel.
5. IP Restriction
Growth and Agency plan subscribers can restrict platform access to specific IP addresses or CIDR ranges. This prevents login from unauthorized networks.
- IP restriction can be applied per role (e.g., Sales Agents only)
- Firm Admins are never subject to IP restrictions — they always retain access
- Supports IPv4, IPv6, and CIDR notation
- Proxy/forwarded IP headers are respected (X-Forwarded-For)
This feature is particularly useful for firms with office-only policies or those in compliance-regulated environments.
6. Infrastructure Security
- Every firm's data is isolated in the application — one firm can never read another firm's records
- CSRF protection on all form submissions
- SQL injection prevention via parameterized queries (Laravel Eloquent ORM)
- XSS prevention via automatic output escaping in all Blade templates
- Rate limiting on login, OTP, and API endpoints
- Security headers against clickjacking and content sniffing (frame-ancestors, X-Frame-Options, nosniff)
7. Backups & Recovery
- Automatic database backup every night, kept for 14 days in private storage
- Backups are never reachable from the web
- You can export your clients and cases at any time from the CRM
8. Security Audits & Monitoring
- Sign-ins from a new IP address must be verified by email code
- Audit logging of important admin actions with time, user and IP
- Sign-in is temporarily locked after 5 failed attempts
9. Reporting a Vulnerability
We take security reports seriously. If you discover a security vulnerability in VisaPilot CRM, please report it responsibly:
Do not disclose vulnerabilities publicly until we have had the opportunity to investigate and issue a fix. We aim to respond to all security reports within 48 hours.
- Email: info@getvisapilot.com
- Subject: [SECURITY] Brief description
- Include: Steps to reproduce, affected component, potential impact
We appreciate responsible disclosure and will acknowledge your contribution publicly (with your permission).
Found a security issue?
Report vulnerabilities responsibly to our security team. We respond within 48 hours and take every report seriously.
Report a Vulnerability