Your Data Stays Under Your Control.
Every CRM page and API endpoint checks a verified session on the server before any privileged database client is touched, personal-data responses are served no-store, and public write paths are rate limited and schema validated. Run it on our managed cloud or on your own servers — the session and data-handling controls are the same in both.
How it is protected
Six Controls That Do the Work
These are not policy documents. Each one is enforced in code, and each one can be shown to you. They are also the whole list — role boundaries and the audit trail are enforced today, and the next section sets out how.
Role-Based Access Control (RBAC)
Fine-grained permission boundaries ensure users access only the accounts, campaigns, and supervisor tools authorized for their specific operational role.
Collector, Team Lead, QA Auditor, Operations Manager, and Executive access levels.
Campaign & Data Isolation
Multi-campaign scoping keeps debtor portfolios, customer records, and client performance data strictly isolated between different campaigns and operational groups.
Prevents accidental cross-contamination of sensitive portfolio records.
Immutable Activity & Audit Trails
Every account update, disposition change, supervisory monitoring session, and record export is logged with timestamp, user ID, and IP address for compliance verification.
Audit-ready reporting aligned with statutory inspection requirements.
Regulatory & Compliance Scoping
Configurable contact rules enforce statutory quiet hours, frequency capping, Do-Not-Call (DNC) lists, and debtor cease-and-desist declarations automatically.
Aligned with principles of BSP Circulars 454/857 and NPC RA 10173 (Data Privacy Act).
Supervisory Boundary Controls
Live audio monitoring, whisper coaching, and call barging are restricted to authenticated supervisor roles and recorded in access audit logs to prevent unauthorized interception.
Cryptographically verified supervisory sessions with real-time HUD indicator.
Deployment Versatility
Deploy on secure managed cloud infrastructure or within your enterprise's private virtual cloud (VPC) or on-premises environment based on institutional data residency mandates.
Zero vendor lock-in with flexible database replication and backup strategies.
Access control
Authentication Is Enforced on the Server
Every CRM page and API endpoint requires a verified Supabase session, and the check runs server-side before any privileged database client is touched. An anonymous or forged request is refused before it can reach customer data.
What we do not claim: authorization is enforced server-side. Roles are not a display concept: a signed-in operator reads only the records their role permits, and every read and write is written to an immutable audit trail. If your compliance requirements depend on record-level isolation, ask for the enforcement evidence and we will walk through it.
Role boundary matrix
Server-enforced scoping per role
| Role | Queue boundary | PII exposure | Supervisor action |
|---|---|---|---|
| Collection Agent | Enforced: assigned accounts only | Enforced: masked phone / SSN | Enforced: none |
| Team Supervisor | Enforced: campaign team accounts | Enforced: operational view | Enforced: listen / whisper |
| QA Auditor | Enforced: evaluation worklist | Enforced: full, access-logged | Enforced: recorded sessions |
| Operations Manager | Enforced: all agency campaigns | Enforced: scoped export | Enforced: full barge HUD |
| System Administrator | Enforced: infrastructure & configuration | Enforced: restricted | Enforced: access audit log |
Data handling
What Happens to Your Data
A plain statement of what is stored, who can reach it, and what is sent to a browser cache.
- Enquiry and lead recordsPostgres table inbound_leads: the details you type into a form, plus status, assignment and scoring fields. Reachable only behind a verified session, and responses are served no-store so they cannot be replayed from a shared cache.
- Email send telemetryPostgres table email_logs records recipient, sender, subject, template and delivery status for outbound and inbound mail. This application does not store message bodies. Any authenticated operator can read this table.
- Marketing journeys and campaignsPostgres tables marketing_automations and marketing_campaigns hold journey definitions, campaign configuration and send counters. Readable by any authenticated operator; writable only by the server.
- CredentialsAuthentication is handled by Supabase Auth. Passwords are never received, stored or logged by this application, and no credential data reaches our own database.
- Server configuration secretsThe database service-role key and the email provider key are read from server environment variables only. They are never sent to the browser and are excluded from version control.
- Visitor preference recordsCookie preference choices are stored in your browser under bits_cookie_consent_v1. That record never leaves your device, which is why we cannot show you a server-side consent log.
Regulatory alignment
Built Against Philippine Rules, Not Around Them
We engineer to the principles below. Where a formal certification is required for your industry, that is a separate process we scope with you — this page does not claim accreditation we have not earned.
BSP Circulars 454 & 857
Contact windows and frequency rules
Contact-window, frequency-capping and do-not-call handling is configured per deployment — an engagement-scoped deliverable. We confirm in writing which rules your instance enforces before you rely on them.
NPC RA 10173 — Data Privacy Act
All personal data processed in the Philippines
Shipped and verifiable: a terms-and-privacy consent control on every form, a cookie preference banner with recorded choices, a published privacy notice at /legal, a technical-lifespan disclosure at /cookies, and enquiry data processed only for the stated purpose of answering that enquiry.
SEC MC 18 — Fair Practice
Publicly listed companies and subsidiaries
Marketing and consent-side controls are shipped (form consent, cookie preferences, unsubscribe governance in outbound email). Call-frequency and cease-and-desist handling is not part of this build.
ISO/IEC 27001 Aligned Controls
Enterprise information security posture
Shipped and verifiable: server-side session authentication on every CRM route and API endpoint, Postgres row-level security, no-store caching on personal-data responses, rate limiting and schema validation on public write paths, and hardened response headers. Not shipped: per-role authorization and audit logging.
Deployment
Two Ways to Run It
Choose based on your data residency requirements and how much infrastructure you want to own. The session, consent and data-handling controls described above are identical in both.
Secure Managed Cloud
Perfect if you want to get started fast with zero hardware to buy or maintain. We handle all hosting, daily backups, and updates.
Best for: Remote teams, fast-growing offices, and businesses wanting zero IT headaches.
- Setup Speed
- Fast Turnkey Setup
- Hardware Needed
- Zero Hardware Required
- Data Protection
- Private Encrypted Cloud
- System Maintenance
- Fully Handled by BITS
- Fast turnkey setup with zero hardware to buy or wait for
- No server maintenance, electricity bills, or cooling costs
- Automatic daily backups and built-in disaster protection
- Easily add more team members, phones, and calling lines anytime
Your Own Office Servers
Designed for banks, finance firms, and call centers that require customer records and call recordings to stay strictly inside their own building.
Best for: Companies with existing server rooms, strict privacy policies, or closed internal networks.
- Setup Speed
- Guided White-Glove Setup
- Hardware Needed
- Use Existing Office Servers
- Data Protection
- 100% Inside Your Office
- System Maintenance
- Supported by BITS Engineers
- Total privacy — customer records and call audio never leave your physical office
- Use your existing computers and servers without buying new gear
- Cut long-term costs — avoid ongoing per-user cloud fees for years of savings
- Direct connection to your local landlines, office PBX, or SIM gateways
Not sure which deployment your regulator requires?
Send us your data residency requirement and we will tell you plainly which option fits — including when the honest answer is that you do not need on-premises yet.