crm logo
Get Started
View Categories

Security FAQs

9 min read

Is PloverCRM secure? #

Yes! PloverCRM implements multiple security layers:

Data Security:

  • ✅ All data stored on your WordPress server (no third-party storage)
  • ✅ HTTPS/SSL encryption required for mobile app
  • ✅ API password system (separate from WordPress password)
  • ✅ HTTP Basic Authentication for API
  • ✅ Role-based access control (RBAC)
  • ✅ Field-level permissions
  • ✅ SQL injection prevention (prepared statements)
  • ✅ XSS protection (data sanitization)
  • ✅ CSRF protection (WordPress nonces)

Authentication Security:

  • API passwords hashed in database
  • Passwords never stored in plain text
  • Separate credentials for mobile/API access
  • Per-user authentication
  • Session management

Access Control:

  • Granular permissions system
  • View scope (all vs owned contacts)
  • Update scope (all vs owned contacts)
  • Field-level read/write permissions
  • Entity-level permissions (notes, lists, tags)

Best Practices:

  • Keep WordPress and plugins updated
  • Use strong passwords
  • Enable two-factor authentication
  • Regular security audits
  • Backup data regularly

Learn more: Security Features

Where is my data stored? #

All data is stored on YOUR WordPress server:

Database Storage:

  • WordPress database (MySQL/MariaDB)
  • Same server as your WordPress site
  • No external data storage
  • No cloud storage (unless you choose)

PloverCRM Backend:

  • Contacts stored in WordPress database
  • Custom fields in WordPress database
  • Lists/Tags in WordPress database
  • Notes in WordPress database

FluentCRM Backend:

  • Contacts stored in FluentCRM database tables
  • Custom fields in FluentCRM database
  • Lists and tags in FluentCRM database
  • Notes in FluentCRM database

What’s NOT Stored Externally:

  • ❌ No data sent to PloverCRM servers
  • ❌ No data sent to third-party services
  • ❌ No cloud synchronization
  • ❌ No external backups (unless you configure)

Mobile App:

  • Connects directly to YOUR WordPress site
  • Data cached locally on device (encrypted)
  • No intermediary servers
  • No data sent to app developers

You Control:

  • Where data is stored (your hosting)
  • Who has access (your team)
  • Backup strategy (your choice)
  • Data retention (your policy)

Is PloverCRM GDPR compliant? #

PloverCRM provides tools for GDPR compliance:

Built-in GDPR Features:

  • ✅ Data stored on your server (data controller)
  • ✅ Contact deletion removes all data (right to erasure)
  • ✅ CSV export for data portability (right to access)
  • ✅ Field-level permissions (data minimization)
  • ✅ Audit logs available (accountability)
  • ✅ No third-party data sharing (data protection)

Your GDPR Responsibilities:

  • 📋 Obtain consent before collecting data
  • 📋 Provide clear privacy policy
  • 📋 Honor data deletion requests
  • 📋 Implement data retention policies
  • 📋 Secure data with HTTPS and strong passwords
  • 📋 Document data processing activities
  • 📋 Appoint Data Protection Officer (if required)
  • 📋 Report data breaches (if occur)

GDPR Checklist:

Consent:

  • [ ] Add consent checkbox to forms
  • [ ] Store consent timestamp
  • [ ] Allow consent withdrawal
  • [ ] Document consent records

Transparency:

  • [ ] Provide privacy policy
  • [ ] Explain data usage
  • [ ] List data processors
  • [ ] Provide contact information

Data Rights:

  • [ ] Right to access (CSV export)
  • [ ] Right to rectification (edit contacts)
  • [ ] Right to erasure (delete contacts)
  • [ ] Right to portability (CSV export)
  • [ ] Right to object (unsubscribe)

Security:

  • [ ] Use HTTPS/SSL
  • [ ] Strong passwords
  • [ ] Regular backups
  • [ ] Access controls
  • [ ] Security updates

Accountability:

  • [ ] Document processes
  • [ ] Train team members
  • [ ] Regular audits
  • [ ] Breach response plan

Learn more: GDPR Compliance | Data Privacy

How are passwords secured? #

Password Security Measures:

WordPress Passwords:

  • Hashed using bcrypt algorithm
  • Salted with unique salt per password
  • Never stored in plain text
  • WordPress core security standards

API Passwords:

  • Generated as random 32-character strings
  • Hashed using WordPress password hashing
  • Stored in user meta (encrypted)
  • Separate from WordPress password
  • Can be reset without affecting WordPress login

Password Generation:

API passwords are automatically generated as secure random strings, hashed using WordPress security standards, and stored encrypted in the database.

Password Verification:

When you connect the mobile app or use the API, PloverCRM verifies your API password securely without exposing the actual password.

Best Practices:

  • Use strong, unique passwords
  • Don’t share API passwords
  • Rotate passwords regularly
  • Reset if compromised
  • Use password manager

Password Requirements:

  • Minimum 8 characters (WordPress default)
  • Mix of uppercase, lowercase, numbers, symbols
  • No dictionary words
  • No personal information

Can I restrict access to sensitive fields? #

Yes! Field-level permissions available:

Permission Types:

  • Create: Can set field when creating contact
  • Read: Can view field value
  • Update: Can modify field value

Configuration:

  1. Go to PloverCRM → Settings → Roles
  2. Edit or create role
  3. Configure field permissions
  4. Assign role to users

Example Use Cases:

Hide Salary Information:

  • Field: Annual Revenue
  • Sales Rep Role: Cannot create, read, or update
  • Sales Manager Role: Can create, read, and update

Protect Email Addresses:

  • Field: Email
  • Support Agent Role: Can create and read, but cannot update (prevent changes)
  • Sales Rep Role: Can create, read, and update

Restrict Custom Fields:

  • Field: Contract Value
  • Junior Rep Role: Cannot create, read, or update
  • Senior Rep Role: Can create, read, and update

How It Works:

  • Fields without read permission hidden in UI
  • Fields without update permission read-only
  • API respects field permissions
  • Mobile app respects field permissions

Learn more: Field-Level Permissions

How do I secure the REST API? #

REST API Security Measures:

Built-in Security:

  • ✅ Authentication required (HTTP Basic Auth)
  • ✅ HTTPS/SSL required for production
  • ✅ Rate limiting (60 requests/minute)
  • ✅ Permission checks on every request
  • ✅ Input validation and sanitization
  • ✅ SQL injection prevention
  • ✅ XSS protection

Additional Security:

1. Use HTTPS:

Always use HTTPS (secure) URLs, not HTTP. Example: https://yoursite.com (not http://yoursite.com)

2. Restrict API Access:

You can configure your server or security plugin to restrict API access to specific IP addresses.

3. Use Security Plugin:

  • Wordfence: Firewall rules for API
  • Sucuri: Rate limiting and blocking
  • iThemes Security: API access controls

4. Monitor API Usage:

  • Enable API logging
  • Review access logs regularly
  • Alert on suspicious activity
  • Block abusive IPs

5. Rotate API Passwords:

  • Change passwords quarterly
  • Reset if compromised
  • Use strong, unique passwords

6. Limit Permissions:

  • Grant minimum required permissions
  • Use role-based access control
  • Review permissions regularly

Learn more: API Authentication | Security Best Practices

What happens if my site is hacked? #

Immediate Actions:

1. Secure Your Site:

  • Change all passwords (WordPress, hosting, database)
  • Reset all API passwords
  • Update WordPress and plugins
  • Scan for malware
  • Remove malicious code

2. Assess Data Breach:

  • Check if contact data accessed
  • Review access logs
  • Identify compromised accounts
  • Document breach details

3. Notify Affected Parties:

  • Inform contacts if data compromised (GDPR requirement)
  • Notify authorities if required (GDPR: 72 hours)
  • Inform team members
  • Update security measures

4. Restore from Backup:

  • Restore clean backup if available
  • Verify data integrity
  • Test functionality
  • Monitor for issues

Prevention Measures:

Before Breach:

  • Regular backups (daily recommended)
  • Security plugin (Wordfence, Sucuri)
  • Strong passwords
  • Two-factor authentication
  • Keep WordPress/plugins updated
  • Limit admin access
  • Monitor security logs

After Breach:

  • Implement additional security
  • Regular security audits
  • Staff security training
  • Incident response plan
  • Insurance consideration

PloverCRM-Specific:

  • Reset all API passwords
  • Review CRM role permissions
  • Check for unauthorized contacts
  • Verify integration settings
  • Monitor API access logs

Learn more: Security Features

Can I audit user actions? #

Limited audit capabilities:

Available Logging:

  • ✅ Integration logs (form submissions)
  • ✅ API access logs (if enabled)
  • ✅ WordPress activity logs (with plugin)
  • ✅ Contact creation/update timestamps
  • ✅ Note creation with author

Not Built-in:

  • ❌ Detailed user action logs
  • ❌ Field change history
  • ❌ Login/logout tracking
  • ❌ Permission change logs

Audit Solutions:

Option 1: WordPress Activity Log Plugin

  • Install “WP Activity Log” plugin
  • Tracks all WordPress actions
  • Includes custom post type changes
  • Monitors user logins
  • Exports audit reports

Option 2: Custom Logging

  • Use WordPress hooks
  • Log specific actions
  • Store in custom table
  • Build custom reports

Example Audit Log (WP Activity Log):

  • 2026-02-04 10:30:00 – User “john” created contact “Jane Doe”
  • 2026-02-04 10:31:00 – User “john” updated contact “Jane Doe”
  • 2026-02-04 10:32:00 – User “john” added note to contact “Jane Doe”
  • 2026-02-04 10:33:00 – User “john” deleted contact “John Smith”

What You Can Track:

  • Contact creation/updates/deletions
  • Note creation/updates/deletions
  • List/tag assignments
  • Stage changes
  • Owner reassignments
  • Custom field changes
  • API access
  • Login attempts

Compliance:

  • GDPR: Audit logs recommended
  • HIPAA: Audit logs required
  • SOC 2: Audit logs required
  • ISO 27001: Audit logs required

Learn more: Audit Logging

How do I backup PloverCRM data? #

Backup Methods:

Method 1: WordPress Backup Plugin

  • Install backup plugin (UpdraftPlus, BackupBuddy)
  • Configure automatic backups
  • Include database and files
  • Store backups off-site

Method 2: Hosting Backup

  • Use hosting provider’s backup feature
  • Schedule daily backups
  • Verify backup integrity
  • Test restoration process

Method 3: Manual Database Backup

Contact your hosting provider or WordPress administrator to perform manual database backups. They can export your WordPress database which includes all PloverCRM data.

Method 4: CSV Export

  • Go to PloverCRM → Contacts
  • Click “Export”
  • Download CSV file
  • Store securely

What to Backup:

  • ✅ WordPress database (includes contacts)
  • ✅ WordPress files (includes plugin)
  • ✅ Custom field definitions
  • ✅ Integration settings
  • ✅ Role configurations

Backup Schedule:

  • Daily: Production sites
  • Weekly: Development sites
  • Before: Major updates
  • After: Bulk imports

Backup Storage:

  • Off-site storage (cloud, external drive)
  • Encrypted backups
  • Multiple backup copies
  • Test restoration regularly

Learn more: Data Retention

Is two-factor authentication supported? #

WordPress 2FA (Recommended):

PloverCRM doesn’t include built-in 2FA, but works with WordPress 2FA plugins:

Compatible 2FA Plugins:

  • ✅ Two-Factor (WordPress.org official)
  • ✅ Wordfence Login Security
  • ✅ Google Authenticator
  • ✅ Duo Two-Factor Authentication
  • ✅ miniOrange 2FA

Setup Process:

  1. Install 2FA plugin
  2. Configure 2FA for WordPress admin
  3. Enable for all users or specific roles
  4. Users set up 2FA on next login

Mobile App Authentication:

  • Mobile app uses API password (not WordPress password)
  • 2FA not required for mobile app
  • API password provides separate security layer

Best Practices:

  • Enable 2FA for all admin users
  • Use authenticator app (not SMS)
  • Backup codes for recovery
  • Enforce 2FA for sensitive roles

Security Layers:

  1. WordPress password + 2FA (admin access)
  2. API password (mobile/API access)
  3. Role-based permissions (data access)
  4. Field-level permissions (sensitive data)

How do I delete all contact data? #

Complete Data Deletion:

Method 1: Delete Contacts Individually

  1. Go to PloverCRM → Contacts
  2. Select contacts
  3. Bulk action: Delete
  4. Confirm deletion

Method 2: Delete All Contacts (PloverCRM Backend)

⚠️ WARNING: This requires technical knowledge and will permanently delete ALL contacts.

Contact your WordPress administrator or developer to perform bulk deletion operations. This should only be done with proper backups in place.

Method 3: Delete All Contacts (FluentCRM Backend)

⚠️ WARNING: This requires technical knowledge and will permanently delete ALL contacts.

Contact your WordPress administrator or developer to perform bulk deletion operations. This should only be done with proper backups in place.

Method 4: Uninstall Plugin

  • Deactivate PloverCRM
  • Delete plugin
  • PloverCRM backend: All data deleted
  • FluentCRM backend: Contacts remain in FluentCRM

What Gets Deleted:

  • ✅ All contacts
  • ✅ All notes
  • ✅ All custom field values
  • ✅ All list/tag assignments
  • ✅ All reminders
  • ✅ All integration logs

What Remains:

  • Custom field definitions (can be deleted separately)
  • List/tag definitions (can be deleted separately)
  • Plugin settings (can be deleted separately)

GDPR Right to Erasure:

  • Delete specific contact
  • All associated data removed
  • Notes, reminders, logs deleted
  • Irreversible deletion

⚠️ WARNING: Data deletion is permanent and cannot be undone. Always backup before deleting.

Related FAQs #

Security concerns? Contact [email protected] for security-related inquiries.

Updated on February 5, 2026
compliance faq gdpr privacy security

What are your Feelings

  • Happy
  • Normal
  • Sad

Get Started with Plover CRM

Tell us a little about your business and what you’re looking to achieve. Our team will help you set up Plover CRM to manage leads, automate workflows, and grow faster with confidence.

Popup Form