Five layers. One brain. Zero ad-network surveillance.
CDK Global went down for three weeks in June 2024 and took half the American dealer body with them. Gladius is engineered so the same playbook doesn’t work twice.
Five layers of defense
Each layer is implemented in our own code, audited at every PR, and instrumented with cron health checks. No third-party security-theatre dependencies.
01
PII columns (names, phones, emails, addresses, SSN-tails) are AES-GCM encrypted at the application layer before Postgres ever sees them. Keys rotate via envelope encryption. Plaintext drop pending; phone-E.164 hash lets webhooks still match.
02
RFC 6238 implementation. AES-GCM wrapped secrets, bcrypt-hashed backup codes, 5-minute pending-MFA cookie for the challenge flow. Dealers can force-enrol every seat via mfaRequiredByDealer.
03
66 diagnostic rules, 53 error signatures, 261 root causes, IQ 145 self-grading engine. Genetic rule evolution. Active deception inside the app. Watches every endpoint across all 5 verticals in real time.
04
Every row carries a dealerId FK. Enforced in tRPC middleware before any handler runs. Single-tenant Postgres database per dealer available on Enterprise. No shared-row leakage path even on a compromised handler.
05
Leads, customers, and deals are never hard-deleted — only flagged via deletedAt. Every state change writes a LeadActivity row. 27 crons are instrumented through cron_runs for retroactive forensics.
The AI watchdog
Autonomous Web Application Intelligence System. Embedded inside the app — not bolted on like a WAF. Learns attacker playbooks, plants deception, evolves its own rules, and watches all five Gladius verticals through one brain.
$ awais --status --verbose
iq_score ........ 145
rules_active .... 66 / 66
signatures ...... 53 / 53
patterns ........ 261 / 261
verticals ....... 5 (mesh OK)
mesh_lag ........ 11s (p95)
ready. watching all surfaces.
What we’re certified for
We publish where we’re compliant, where we’re in progress, and where the framework doesn’t apply. If you’re an auditor, your evidence packet is ready.
Column-level PII encryption, access controls, MFA on every account, encryption-in-transit (TLS 1.3 + HSTS preload), incident response plan, vendor risk management.
Customer NPI is encrypted in flight and at rest; access is tenant-scoped and audited. Privacy notice surfaced to consumers via /privacy.
Trust services criteria mapped to controls. Continuous evidence collection in place. Auditor engagement targeted Q4 2026. We will publish the report under NDA on request.
Card data never touches our servers. Stripe Elements hosts the form; we receive only a tokenized reference. Out-of-scope for the full PCI envelope.
Request architecture
A request from a dealer’s laptop has to clear all six before it touches a database row. Each checkpoint is its own audit log.
01
Request
Browser → Vercel Edge / CDN. TLS 1.3, HSTS preload, COOP, CORP. Strict CSP rejects unknown script origins.
02
AWAIS gate
Every request screened by Defense — bot scoring, fingerprint, behavioral z-score, deception traps. Hostile traffic gets a doppler response, never the real route.
03
Next.js Edge / Node runtime
Stateless HMAC-signed JWT-style session in an httpOnly + Secure + SameSite=Lax cookie. No 3rd-party auth dependency since 2026-05-27.
04
tRPC middleware (tenant gate)
Session decoded, dealerId resolved, MFA verified. Every router input passes Zod validation. dealerId FK auto-stamped on every Prisma write.
05
Prisma ORM
Parameterized queries only — no string-concat SQL anywhere in the surface. dealerId required on every read; cross-tenant queries throw at the model layer.
06
Postgres (Supabase)
Encrypted at rest. RLS policies as defense-in-depth. Single-tenant Postgres available on Enterprise. Backups encrypted with separate KMS keys.
vs. the legacy CRM vendors
When CDK Global went dark in June 2024, the entire industry learned how brittle the incumbents’ security model is. Here’s how Gladius is engineered differently.
Control
Gladius
Typical legacy CRM
PII column-level encryption
AES-GCM in every PII column
Row-level disk encryption only
MFA enforcement
Dealer-wide force-enrol switch
Optional, opt-in per seat
Application-layer threat detection
AWAIS — embedded, self-learning
Perimeter WAF only
Multi-tenant isolation
tRPC middleware + Enterprise single-DB option
Shared row, app-level filter only
Breach disclosure SLA
72 hours, written, in contract
Silence until press inquiry (see CDK June 2024)
Soft-delete + audit trail
Every row, every state change
Hard deletes overwrite history
“Typical legacy CRM” column reflects publicly documented architecture from major incumbents (Reynolds & Reynolds, CDK Global, DealerSocket, VinSolutions) as of the CDK Global incident, June 2024. Where individual vendors have since improved, we’ll happily update — send a pointer to security@gladiuscrm.com.
Our pledges
These are not aspirations — they live in our MSA and they hold in court.
Responsible disclosure
Email security@gladiuscrm.com with a description, reproduction steps, and the impact you believe it has. We acknowledge within 24 hours, fix high-severity issues within 7 days, and pay a bounty from $250 for low-impact findings up to $10,000 for critical pre-auth RCE / multi-tenant data crossing. No legal action against good-faith researchers — that’s our pledge.
Gladius Technologies LLC · Tampa, FL · 2026