# Security at Sashimi Every workspace is isolated, and every call, including those from your AI client, runs with the caller's live role. AI access is personal, revocable and can be read-only. Connector tokens are stored as hashes, other keys are encrypted, and an activity log records each AI call without the values sent. There is no third-party certification yet. By Alfonso Trocolí, founder · Updated October 27, 2026 Canonical: https://sashimicrm.com/security **Processors used by Sashimi (as of October 26, 2026)** | Provider | Purpose | When it applies | | --- | --- | --- | | Railway | Hosts the Sashimi app and its database | Always | | Resend | Sends Sashimi's own emails: email verification, workspace invitations, the daily summary (with CRM data such as task and deal names) and beta access requests and their confirmations | Always | | Cloudflare | Serves this public website, once the site is deployed on it | When you visit this website | | Cloudflare (Turnstile) | Checks that a person sent the beta access request form on this website | Only when that form is used | | Google (Gmail) | Reads new messages and sends email from a connected mailbox | Only if you connect Gmail | | Anthropic | Runs Sashimi's built-in AI features on Sashimi's account: onboarding suggestions, agents and research | Only when your workspace uses them without its own AI key; agents are off by default | | Your workspace's AI provider | Runs agents and research on your own key, under your own contract | Only if a workspace admin connects a key | | Apollo | Searches and enriches prospects | Only if your workspace configures an Apollo key | | Telnyx | Phone numbers and calling | Not in use today; used only if telephony is switched on | ## How is each workspace kept separate? Every row of CRM data carries its workspace, and every query is filtered by it. An AI connection belongs to one workspace, chosen when you approve it, and cannot switch to another. Tests check that one workspace cannot read or change another's data. ## Who can do what inside a workspace? Roles are checked on every call, from the web app, from your AI client and from Sashimi's agents. The role is read live from the membership each time. What a member cannot do in the web app, their AI cannot do either. - There are three roles: owner, admin and member. - Settings, members, integrations, deleting records through an AI client and emptying the trash need an admin. - A connection marked read-only is refused any write. - When an agent proposal needs a person's approval, the approver's role must also allow the action. ## How does an AI client connect, and how do I cut it off? Through OAuth or a personal connector link. Every connection belongs to one person and one workspace. You can list your connections and revoke any of them from the web app or by asking your AI client. Admins can revoke anyone's. - **OAuth.** Your AI client sends you to Sashimi. You sign in, pick a workspace and approve the app by name. The connection expires after 30 days without use, and after 90 days in any case. - **Personal links.** A link created since October 2026 expires after 90 days. It can be read-only. The first use from a new IP address is flagged in the activity log. - **Rate limits.** Each connection has a per-minute call limit. ## How are passwords, tokens and keys stored? Never in plain text. Passwords are stored as one-way hashes. Personal connector links are stored as a hash and shown in full once, when you create them. Besides the hash, only their first 12 characters are kept, so you can recognise each link in the list. Gmail tokens are encrypted and never shown. Keys for data and AI providers are encrypted, and only their last four characters are shown again. They are never sent through your AI chat. They are entered in the web app, and the AI connector has no tool that accepts one. ## Can I see what my AI did? Yes. The MCP activity log records every call from an AI client, every action by a Sashimi agent and every change in the web app: who, which connection and app, which tool, which records and the result, without the values sent. Entries are kept for 180 days. MCP is the open standard your AI client uses to connect to Sashimi. Ask your AI client to run `list_mcp_activity` to read the log. Members see their own activity; admins see the whole workspace. Agents also keep a step-by-step record of each run, and that record does include the arguments and results of each tool call. The [privacy policy](https://sashimicrm.com/privacy) explains how long it is kept. ## What stops a malicious note from steering my AI? Sashimi treats everything its tools return as data, not instructions. Notes, emails, imports and fields can be written by other people. This kind of attack is called prompt injection. Every result from the connector carries a notice that it is data, and invisible Unicode characters are removed before your AI sees it. The connector's instructions tell your AI not to follow instructions found in returned text, and to tell you about them instead. Sashimi's agents are told that tool results are data, not orders. ## How is traffic protected? With HTTPS and HSTS, a header that tells browsers to use only HTTPS for the site. The app and this website both send it. Pages carry a Content Security Policy that only runs the site's own scripts and Cloudflare Turnstile, which the beta access request form on this website loads. Both also send X-Content-Type-Options, Referrer-Policy and Permissions-Policy, and forbid other sites from embedding their pages in a frame. ## How is AI spending kept under control? AI features inside Sashimi run on your workspace's own AI key, if an admin connects one. Otherwise they run on Sashimi's account, which is capped per workspace and overall each month. Agents are off by default, and each agent has its own budget and a cap per run. ## Where is my data stored, and is it backed up? The app and its database run on Railway, in its European region (Netherlands, `europe-west4`). Backups are handled by Railway for each database, and a restore has been tested. There is a daily backup, kept 6 days, and a weekly backup, kept one month. ## What does a data processing agreement with Sashimi cover? For the CRM data in your workspace, you are the controller and Sashimi is your processor. Sashimi processes that data only to run the service for you, uses the processors in the table above, and returns or deletes it when you ask. - **Roles.** Your workspace controls its CRM data. Sashimi controls only account data, such as your name, email and sign-in. - **Processors.** Only those in the table above, each only when it applies. - **Return and deletion.** You can export leads, companies and deals as CSV at any time. Deleted records can be restored from the trash for 30 days. The [privacy policy](https://sashimicrm.com/privacy) sets out when they are purged and how long temporary data is kept. - **Requests.** To ask for a data processing agreement, write to [alfonso@mail.atm-dev.com](mailto:alfonso@mail.atm-dev.com). We offer a signed agreement on request, on the terms above. ## Does Sashimi hold security certifications? No. Sashimi has no third-party security certifications yet. Everything on this page describes what the product does today. ## How do I report a security problem? Write to [alfonso@mail.atm-dev.com](mailto:alfonso@mail.atm-dev.com). Please include enough detail to reproduce it, and give us time to fix it before you share it. See also the [privacy policy](https://sashimicrm.com/privacy), the [terms of service](https://sashimicrm.com/terms) and the [home page](https://sashimicrm.com/). ## Frequently asked questions ### Can my AI client reach another workspace? No. Each connection is tied to one workspace when it is created, and every query is filtered by that workspace. ### Does Sashimi have a security certification? Not yet. Sashimi has no third-party security certifications. This page describes what is built today. ### Can I make my AI connection read-only? Yes. A personal connector link can be created read-only. Any attempt to write through it is refused.