Security

Last updated 9 August 2026

Deduptio works inside your CRM, so we treat your data the way we'd want ours treated: read as little as possible, write only what you approve, keep nothing longer than the job needs. Here's how that works in practice.

How we handle your Attio data

Scans are read-only. Deduptio reads your records to find duplicates. Nothing is created, changed, or deleted in Attio during a scan or a merge preview.

Writes happen only on your say-so. The only times we write to your workspace are the actions you explicitly confirm: merging a duplicate group, cleaning up a duplicate list entry, or restoring one. Every one of those is reversible for 24 hours.

We keep the minimum. During a scan, working data lives in temporary tables that are deleted when the scan finishes. What remains afterwards is what the product needs to show you: the matched fields of records in a duplicate group, and short-lived snapshots that power the 24-hour rollback. Expired snapshots are purged automatically by a daily job. We never sell data or use it to train anything.

How things are protected

Your Attio access tokenis encrypted at rest with AES-256-GCM and is never shown or logged. You can revoke it at any moment from Attio's workspace settings.

Your passwordis hashed with Argon2id — we couldn't read it if we wanted to. Sessions use hashed tokens, and login attempts are rate-limited.

In transit, everything goes over HTTPS/TLS. State-changing requests are CSRF-protected.

Infrastructure. Deduptio runs on Vercel with a managed Postgres database (Neon); both encrypt data at rest and are SOC 2 audited. We connect to Attio only through its official OAuth API — no passwords, no browser automation.

Access

Your workspace data is scoped to your account — other customers can't see it, and operational access on our side is limited to what's needed to run the service, with admin actions logged.

Deleting your data

Disconnect Deduptio from Attio's integration settings whenever you like — that cuts our access immediately. Want your Deduptio account and stored data erased too? Just ask, and it's done.

Found a vulnerability?

Please tell us at help@deduptio.com or via the contact form. We read security reports first and respond fast — good-faith research is always welcome.

For the formal version of what we collect and why, see the Privacy Policy.