Data and security
Commission Slate runs inside your Zoho CRM. Here is exactly what it touches.
For the Zoho CRM extension: nothing is sent to Skyfall Labs servers. The extension has no external calls, so your CRM data never leaves your Zoho organisation. The standalone web app works differently; see The web app below.
What it reads
- Deals, Invoices and Sales Orders, for the modules you choose as sources.
- CRM users, so commission can be assigned to payees.
- Contacts, accounts or vendors, only if you pay them.
- The specific fields you map in the setup wizard (amounts, owners, dates, statuses).
What it writes
Only its own modules: Commission Plans, Commission Rules, Commission Ledger, Commission Payouts and Commission Logs. It never modifies your Deals, Invoices or Sales Orders.
Where data lives
Everything is stored in your own Zoho CRM organisation, under Zoho’s security and data-residency controls. There is no separate Commission Slate database for extension data and no third-party service involved.
Permissions
You approve the permissions on Zoho’s consent screen when you install, and choose which CRM profiles can use the extension. Access follows your existing CRM profiles and sharing rules.
Rep privacy
Ledger lines and payouts are owned by the payee. With Commission Ledger sharing set to Private in Data Sharing Settings, reps see only their own lines. The Commission Breakdown button hides other payees’ amounts from non-admins.
Uninstall and deletion
Uninstalling deletes all Commission Slate data from your organisation. Your CRM records are untouched. See the Installation guide.
The web app
The standalone web app at app.commissionslate.com stores its data in our own infrastructure, unlike the Zoho extension. Its protections:
- Encryption in transit: all traffic uses TLS.
- Passwords: stored only as hashes, never in plain text.
- Organisation isolation: enforced on the server, so one organisation cannot read another’s data.
- Role-based access: members see what their role allows; reps see only their own commission.
- Audit log: actions in your organisation are recorded.
- Installable app, no cached data: the PWA’s service worker never caches API or organisation data on your device.
Details of what we collect are in the Privacy Policy.
This website
commissionslate.com collects data only if you join the waitlist. It is handled as described in the Privacy Policy, and is separate from the extension.
Report a security issue
Email [email protected] with “Security” in the subject and as much detail as you can. We will acknowledge within 1 business day.