Built to be trusted with your data.
The OneRoof CRM holds Social Security numbers, call recordings, bank links and homeowner records — so the security model, the legal terms, and the way third-party data is used are all here in the open. Everything below reflects the platform as currently built and internally reviewed.
Policies, security & data use
Terms of Service
The full agreement governing use of the platform — accounts, fees, acceptable use, telephony/TCPA, prospecting/FCRA, indemnification, and arbitration.
Read the Terms →Privacy Policy
What we collect, how we use it, our two roles (controller vs. processor), retention windows, your state privacy rights, and the Google & Microsoft data-use disclosures.
Read the Policy →Data Processing Addendum
Our service-provider commitments, sub-processor terms, 72-hour breach notice, audit rights, and the Annex II security measures and Annex III sub-processor list.
Read the DPA →Security
Field-level AES-256-GCM encryption of SSNs, stored email & OAuth tokens; TLS in transit; role-based access with least privilege; row-level per-org tenant isolation; audit logging of sensitive access; and signed-URL object storage — no raw file keys.
See Annex II measures →Sub-processors
Every vendor that touches data, by function: cloud hosting & storage (Cloudflare, AWS), telephony (Telnyx), AI processing (Anthropic, Google), email & calendar (Google, SendGrid), a property & owner data provider, roof measurement (EagleView), materials (ABC Supply), payments (Stripe), and bank linking (Plaid). Document rendering and e-signature run on our own OneRoof DocumentAI service — no third party.
See the full list →OAuth & data use
Connect Google or sign in with Microsoft — with strict limits on what that access is used for.
Google API Services · Limited Use Microsoft Identity · Sign-In
Gmail data is never used to train AI and only powers the feature you asked for; Microsoft is sign-in only. Details in Section 9 and Section 9A.
Read the disclosures →How risk is allocated
The Terms of Service put the responsibility for how you use the platform on you — because you control the calls, the data, and the contracts. Here is the short version, with links to the exact provisions.
- You indemnify & hold us harmless for third-party claims arising from your use of the Services and your data. Terms § 19.
- TCPA & call-recording compliance is yours. You are responsible for consent, do-not-call scrubbing, and two-party-consent rules on every call. Terms § 10.
- FCRA responsibility is yours. Prospecting & skip-traced data is not a consumer report and may never be used for credit, insurance, employment, or housing eligibility. Terms § 11.
- The Services are provided "AS IS." We disclaim implied warranties to the extent the law allows. Terms § 20.
- Liability is capped at the fees you paid in the prior twelve months, with no indirect or consequential damages. Terms § 21.
- Disputes go to binding arbitration in El Paso County, Colorado, with a class-action and jury-trial waiver (30-day opt-out). Terms § 24.
Questions about privacy, security, or the terms?
OneRoof Labs LLC
Attn: Legal / Privacy / Compliance
655 S Sierra Madre Street, Colorado Springs, CO 80903
compliance@onerooflabs.com