Email and password
Handled by Firebase Authentication. Credentials are managed by Firebase, not stored by TotalDeal. Password reset is sent by Firebase to the account email.
How TotalDeal is built, and what we will and won't claim about it
Written for the person on your team who has to sign off before a purchase. It describes the actual architecture, and it states plainly which certifications and capabilities we don't have — because finding that out on a call three weeks in wastes everyone's time.
Infrastructure
TotalDeal runs entirely on Google Cloud, through Firebase.
| Layer | What it runs on |
|---|---|
| Application hosting | Firebase Hosting, served over HTTPS |
| Database | Cloud Firestore |
| File and document storage | Google Cloud Storage for Firebase |
| Server-side logic | Cloud Functions for Firebase, Node.js 20 runtime |
| Authentication | Firebase Authentication |
Google Cloud encrypts data at rest by default as a property of the platform. TotalDeal does not add application-level field encryption or customer-managed encryption keys, and we don't describe the platform default as though it were a TotalDeal feature.
Signing in
Google sign-in
Sign in with a Google account, so your organization's existing Google Workspace controls apply to the login itself.
Single-use sign-in links
Some flows use a one-time link. The token is validated server-side, marked used so it cannot be replayed, and expires. Link records are not readable by client applications.
No multi-factor authentication
TotalDeal does not currently offer MFA or 2FA on user accounts. If your policy requires it, using Google sign-in lets you enforce MFA at the identity-provider level instead.
Workspace access and permissions
Customer data is organized under a workspace, and access to it depends on an active membership record for that workspace.
Access rules are enforced server-side by Firestore security rules rather than only in the interface. A request for workspace data requires a signed-in user with a membership record for that workspace that has not been disabled, so removing or disabling a member cuts off access at the data layer.
| Role | What it controls |
|---|---|
| Owner | Full access, including deleting the workspace and managing invitations. Financial visibility by default. |
| Admin | Workspace settings, team management, and administrative actions. Financial visibility by default. |
| Manager | Team-level responsibilities such as forecast review. Financial visibility requires an explicit grant. |
| Member | Day-to-day CRM work. Financial visibility requires an explicit grant. |
Financial information is treated separately from general CRM access: owners and admins see it by default, while managers and members need it granted to them explicitly. Outside of that, members of a workspace generally share access to that workspace's CRM records — TotalDeal does not offer record-level or field-level permissioning.
Operator access. A small number of designated TotalDeal operator accounts can access workspace data for support and platform administration. We'd rather state that than let you assume otherwise.
Client portal and shared link access
Your customers don't get TotalDeal user accounts. They reach shared material through a link, and it's worth understanding exactly what that means.
How access works
Portals, shared documents, and public invoice pages are reached through a long, unguessable token in the URL. The token is hashed before it's used to look up the record, so the stored reference is not the link itself. Anyone holding the link can open what it points to.
Turning access off
A portal can be disabled, a document's public link can be switched off, and invoice links can be deactivated or given an expiry date — all enforced server-side, so an old link stops working.
Optional extra gates
Some document links support a PIN, which is stored and verified server-side. A portal can also be limited to a list of email addresses; treat that as a friction control rather than strong authentication, since it doesn't cryptographically prove who's on the other end.
Portal roles
People you invite to a client portal get a role: Owner can sign, pay, and upload; Billing can pay invoices; Viewer is read-only.
The practical guidance: a portal link is a capability — treat it like a password. Send it to the people who should have it, disable it when an engagement ends, and add a PIN for anything genuinely sensitive.
Payments
TotalDeal never sees or stores full card numbers.
Customer payments run through Stripe. When you send a pay link, the customer enters their card or bank details on Stripe's own hosted checkout, not in TotalDeal. What comes back and gets saved against the invoice is a summary — card brand and last four digits — so your team can identify the payment. Card numbers and security codes are never collected or stored by the application.
Payments are made to your own connected Stripe account, so the funds relationship is between you and Stripe. Both card and US bank account payments are supported. TotalDeal's own subscription billing is handled by Stripe as well.
Data in transit and browser protections
The application is served over HTTPS.
These response headers are configured across the site:
| Header | Value |
|---|---|
Referrer-Policy | strict-origin-when-cross-origin |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
Permissions-Policy | camera=(), microphone=(), geolocation=() |
A Content-Security-Policy and HTTP Strict-Transport-Security header are not currently configured, so we don't list them as controls.
Third-party services that process data
Being specific about this is usually what a security reviewer actually needs.
| Service | Purpose | When it applies |
|---|---|---|
| Google Cloud / Firebase | Hosting, database, file storage, authentication, server functions | Always |
| Stripe | Payment processing and TotalDeal subscription billing | When you use invoicing or pay a subscription |
| Resend | Sending transactional and campaign email | When email is sent from the workspace |
| OpenAI | Powering AI features such as Ask and deal coaching | When AI features are used (Pro plan) |
| Google Analytics | Marketing website analytics | On this public website, not inside the application |
| QuickBooks Online | Invoice synchronization | Only if you connect it |
| Apollo, SerpAPI, Hunter, Google Maps | Optional lead search and enrichment integrations | Only if you enable them with your own API keys |
On AI and your data: when a workspace uses AI features, relevant CRM content is sent to OpenAI to generate the response. AI features are available on the Pro plan, and there are server-side controls that let us disable individual AI features or all of them.
Activity history
Records carry an activity history, and several sensitive flows write server-side event logs that clients cannot modify — document lifecycle events, client-portal document activity, and server-executed actions among them. Documents also track when they were viewed and by whom on the customer side.
This is useful for reconstructing what happened on a deal or a document. It is not a unified, exportable, compliance-grade audit log across the whole workspace, and we won't describe it as one.
What we do not claim
Everything in this list is something TotalDeal does not have today. If any of it is a hard requirement, we're likely not the right fit yet — and it's better to know now.
- SOC 2 — no Type I or Type II report
- ISO 27001 — not certified
- HIPAA — no BAA offered; do not put protected health information in TotalDeal
- GDPR or CCPA certification — no formal certification or published DPA and subprocessor agreement
- Third-party penetration test report — none to share
- Multi-factor authentication — not available on TotalDeal accounts
- Content-Security-Policy or HSTS headers — not currently configured
- Customer-managed encryption keys or field-level encryption — not offered
- Record-level or field-level permissions — access is by workspace membership, with financial data as the one separately gated category
- Single sign-on with SAML or SCIM provisioning — not available; Google sign-in is the closest option
- Guaranteed tenant isolation — data is scoped by workspace membership in security rules, which is not the same as a formal isolation guarantee, and we don't market it as one
TotalDeal is built for growing B2B teams, and this list reflects that honestly. If your buyer's security review requires a SOC 2 report, TotalDeal will not clear it.
What we can confirm
- Hosted entirely on Google Cloud through Firebase, with encryption at rest as a platform default
- Served over HTTPS, with Referrer-Policy, X-Content-Type-Options, X-Frame-Options, and Permissions-Policy headers configured
- Authentication through Firebase, with email and password or Google sign-in
- Access to workspace data enforced server-side by security rules based on active membership
- Owner, admin, manager, and member roles, with financial visibility gated separately
- Client and document access through unguessable tokens that can be disabled, expired, or PIN-protected
- Card details handled entirely by Stripe; the application never collects or stores full card numbers
- Server-side event logging on document lifecycle, portal activity, and executed actions
- A defined process for permanently deleting a workspace and its data on request
Questions this page doesn't answer
If your review needs details on data residency, retention periods for a specific record type, backup and recovery procedures, incident response commitments, or a signed data-processing agreement, ask directly rather than inferring an answer from this page. Bring the question to a demo or email support and you'll get a straight response, including where the answer is "we don't have that."