# CRM Security and Patient Data Protection | Websens CRM > How Websens CRM protects patient data: account isolation, roles and permissions, two-factor authentication, audit log, encrypted keys and daily backups. Kaynak: https://crm.websens.co/en/security Security and data # Patient data is protected in detail. In health tourism, you work with sensitive information such as patient photos, phone numbers, and conversation history. Here, we describe without exaggeration which measures are actually implemented in Websens CRM. Measures in place ## Live controls in the product. ### Accounts are isolated from one another Each organization's data is tied to its own account. The system does not allow a user of one organization to access another organization's leads, messages, or files. ### Role and permission control Users other than administrators are granted only defined permissions: each action—such as viewing leads, replying to messages, exporting, or deleting—is a separate permission. A user can be restricted to see only the leads and channels assigned to them. ### Two-step verification Each user can add two-step verification to their own account. An administrator can make it mandatory for all users in the organization. ### Audit log Create, update, and delete operations performed in the panel are logged with who performed them and when. Administrators view the log from the panel. ### Keys and tokens are encrypted We store Meta and TikTok connection tokens and your own AI key encrypted in the system. Passwords are kept in an irreversible form (hashed). ### Patient files in a private area Uploaded photos and documents are not kept at a public address; they are served only to logged-in and authorized users, after verification. ### Webhook signature is verified Events coming from Meta and TikTok go through signature verification; requests with invalid signatures are not processed. Rate limiting is applied to public endpoints. ### Daily backup A daily backup of the database is taken and recent backups are retained. Backups and system health are regularly audited. ### You own your data You can export leads as Excel/CSV and download your account data. When you request it, your account is permanently deleted with all its data. Audit log: who changed what and when. (From a demo account, with fictional data.) Transparency ## What we do not say also matters. We do not yet have an independent security certification such as ISO 27001 or SOC 2, and we do not act as if we do. Instead, we clearly state the controls we implement, the infrastructure providers we use, and who is responsible for the data. - System data is hosted in Hostinger's European data centers. - Payments are processed through PayTR; your card details are not stored by us. - The AI feature is optional; if you do not enable it, data is not sent to the AI provider. - You are the data controller for patient data, and Websens is the data processor. [Read the Privacy Policy](https://crm.websens.co/en/privacy-policy) · [Terms of Use](https://crm.websens.co/en/terms-of-use) Are you conducting a security assessment? If your organization has a security or KVKK questionnaire, send it to us; we will match it against the controls we implement and answer honestly. [Write to us](https://crm.websens.co/en/contact) FAQ ## Security FAQs ### Where is my data hosted? Websens CRM runs in Hostinger's European data centers. The full list of our providers and the data transferred to each are set out in the Privacy Policy. ### Who is the data controller, and who is the data processor? For the data of your patient candidates, you, the organization, are the data controller; Websens acts as the data processor only on your instructions and to provide the service. Details are in the Privacy Policy. ### When the AI feature is on, is my data sent to the AI provider? Yes. When the AI chatbot is enabled, the relevant chat text is sent to the AI provider to generate a response. If you never enable the feature, no data goes to the AI provider. If you wish, you can use your own provider key. You must inform your patients about this. ### Is my card information stored in your system? No. Payment is completed on PayTR’s own secure page; card information never enters the Websens system. ### Do you have ISO 27001 or SOC 2 certification? We do not currently. That is why, instead of making claims, we clearly document each of the controls above. For your security questions or assessment forms, you can email info@websens.co. ## Try it yourself first. 14 days free, no credit card required. See permissions, the audit log, and two-step verification in your own account. [Try for free](https://crm.websens.co/register) [Request a demo](https://crm.websens.co/en/contact)