Built and hosted in Canada, with the rules in mind
Your clients' data is stored and processed in Canada; Stripe and any tools you connect handle what you send them. Every safeguard, from consent-aware messaging to role-based access, is built in, by a team you can actually reach.
Your own private space
Every business on AscendCRM lives in its own walled-off space. The wall is built into the database itself, not just the screens, so one business can never see another’s data.
Role-based access
Owner, team lead, agent and assistant roles gate what each person can see and do. Sensitive settings stay with owners and team leads.
Per-deal delegation
Hand someone a single task on a single file ('upload disclosures here') instead of the whole deal.
Human-in-the-loop AI
Tara proposes and you approve: nothing she writes reaches a customer until you say yes. A few routine emails go out on their own: appointment reminders, overdue-invoice reminders, review requests and waiting-list offers.
Encryption & two-step sign-in
Post-quantum key exchange in transit, two-factor sign-in with an authenticator app or a passkey on every account, and audit trails on sensitive records.
Your data, portable
Documents live in object storage in Canada, with clean export. Cancel anytime and take everything with you. No lock-in.
Built to keep you on the right side of the rules
Real estate runs on regulations: anti-spam, privacy, record-keeping. AscendCRM is designed around Canada's, so staying compliant is the default, not a chore.
CASL-friendly messaging
Canada's anti-spam law means you need consent. Announcements only go to customers whose consent is current, opt-outs are respected, and nothing Tara writes reaches a customer until you approve it.
Canadian privacy law
Built with PIPEDA and provincial privacy laws in mind: clear purposes, access and deletion on request, and no selling of your (or your customers') personal information.
Data hosted in Canada
Your leads, clients and documents live in AWS's Canadian regions (Calgary and Montreal), with clean export whenever you want it. If you connect Stripe, it processes card payments outside Canada.
Record-keeping support
An audit trail on sensitive records helps you keep the paper trail your board and regulator expect.
AscendCRM is a trade name of Ascentsai Inc., a corporation registered in Canada, and your data is stored in Canada. AscendCRM gives you the tools to stay compliant; it isn't a substitute for legal advice. See our Privacy Policy and Terms.
Where we actually stand
Independent certification matters, and it's earned, not claimed. Here's exactly what's in place today and what's underway, so you can judge for yourself instead of trusting a badge.
Connections use hybrid post-quantum key exchange: X25519MLKEM768, which combines classical X25519 with ML-KEM-768, the algorithm NIST standardised. It is designed to protect traffic against being recorded today and decrypted years from now once quantum computers can break RSA and elliptic curve. Your own security team can confirm it in one command: openssl s_client -connect app.ascendcrm.ca:443 -brief. To be straight about the limit: this covers key exchange. Certificates and signatures are still classical here, as they are everywhere, because no public certificate authority issues post-quantum certificates yet.
Your data is stored and processed in AWS's Canadian regions, Calgary and Montreal. This is a fact about how we run, verifiable today, not a certification.
These are laws we operate under, not badges to be awarded. Our privacy practices, access and deletion handling are designed with them in mind.
We run our own security reviews today. A third-party test by a qualified firm is the next step, and we'll share the summary with customers who ask.
The controls a SOC 2 examines (tenant isolation, access control, MFA, audit logging, encryption, change management) are already how the product is built. The audit itself needs a licensed CPA firm and an observation window, and we haven't engaged one yet.
No engagement underway. For Canadian buyers SOC 2 is the usual request, so that comes first unless customers tell us otherwise.
SOC 1 covers controls affecting your financial reporting. If your auditors come to rely on our books features, we'll revisit it.
We will never display a certification we haven't earned. If a certification matters for your purchase, tell us and we'll give you our security documentation and a straight answer on timing.
Everyone sees exactly what they should
Two levels of permission (team roles and per-deal hand-offs) so you can share the work without sharing sensitive details.
Security your business can stand behind
Customers, quotes, invoices, bookings, team, the books: your whole business in one login, instead of a stack of apps. Start free, no card, no catch.