Your email, your CRM, your server.
Radar holds access to genuinely sensitive things: mailboxes, customer records, API credentials and AI-drafted correspondence. Here is exactly how it is handled.
Runs on your own hardware
Radar is self-hosted — a Raspberry Pi with an SSD is enough. The database is not exposed to the internet; only ports 80 and 443 are, behind automatic HTTPS.
Source systems stay authoritative
Outlook owns the message, the CRM owns the deal, Odoo owns the activity. Radar caches to be fast, and writes back only when you take an explicit action.
Credentials encrypted at rest
Provider tokens and API keys are encrypted with AES-256-GCM using a master key held outside the database. Secret values are never returned to the browser — the app only ever learns that a credential is configured.
Organisation isolation
Every record carries its organisation and user. Isolation is enforced in the database queries, not in the interface, and every release runs automated tests that try to read across organisations.
AI is an assistant, not an agent
Radar sends only the email you opened, a few earlier messages in that thread, the linked opportunity’s headline fields, recent CRM notes and matching company knowledge. It asks OpenAI not to retain the response. It cannot send email, change a deal or create a CRM action without your click.
Backups that are actually tested
Nightly encrypted backups include the database, uploaded documents and the encryption key, with an off-site copy to storage you already own. A scheduled job restores the latest backup into a scratch database every week to prove it works.
Also true
- Passwords are hashed with Argon2id; sessions are server-side, revocable and listed per device
- CSRF protection, rate limiting, strict security headers and a content security policy on every response
- Website and custom-endpoint fetching is protected against SSRF — Radar refuses local and private addresses, including through redirects
- An audit trail records sign-ins, connection changes, AI sends and CRM write-backs
- You can export everything Radar owns about you as JSON, disconnect a provider and purge its cache, or delete your account and workspace outright
- No third-party analytics, advertising or tracking in the app — product analytics live in Radar’s own database. This website uses Google Analytics only if you accept it
Put it on your Radar.
Radar is in private beta. Tell us what you’re juggling, at work and at home, and we’ll send you an invitation.