Skip to main content

Secure Messages for Perfex CRM

Version: 1.2.0 - 05/07/2026
Author: Cloudmill
Support: Dit e-mailadres wordt beveiligd tegen spambots. JavaScript dient ingeschakeld te zijn om het te bekijken.

1. Introduction

Secure Messages lets you share sensitive information such as passwords and API keys through Zero-Knowledge AES-256 encryption. Messages are encrypted in the browser before anything is sent, so the server never sees the plain text or the decryption key. Staff can create secure messages from the admin area, clients can create them from the customer portal, and both sides can exchange them directly from support tickets.

2. Installation

Follow these steps to install the module in Perfex CRM.

Step 1 – Download

Download the module ZIP file from CodeCanyon.

Step 2 – Upload the Module

Log in to your Perfex CRM Admin Panel and navigate to: Setup → Modules

Click Upload Module and select: secure_messages.zip

Step 3 – Activate the Module

After uploading, click Activate to enable the module.

Step 4 – Configure Permissions

Navigate to: Setup → Staff → Permissions

Enable the Secure Messages permission for the staff members who should be allowed to create and manage secure messages.

3. Data Destruction & Security

The module is designed to ensure that sensitive information does not remain stored longer than necessary.

Two independent mechanisms ensure automatic data removal.

Burn-After-Reading

When the Burn-After-Reading option is enabled:

  1. The recipient opens the secure message.
  2. The message is decrypted locally in the browser.
  3. Once the message is opened, the encrypted record is immediately deleted from the database.

This ensures that the message can only be viewed once.

Automated Expiration via Cronjob

Messages that are not configured for burn-after-reading are automatically removed using the Perfex CRM Cronjob system.

The system performs the following actions:

  1. The module stores an expiration timestamp when the message is created.
  2. The Perfex Cronjob runs.
  3. During each Cronjob execution, the module scans the database for expired messages.
  4. Any message whose expiration time has passed is permanently deleted from the database.

Cronjob Requirement

Your Perfex CRM Cronjob must be configured correctly on the server. This ensures that expired secure messages are removed automatically and the database remains clean.

4. How the Encryption Works

The module follows a Zero-Knowledge security model, meaning the server never has access to the decryption key.

The process works as follows:

Step 1 – Client-Side Encryption

When a user creates a secure message, JavaScript encrypts the message using AES-256 encryption directly in the browser.

Step 2 – Server Storage

Only the encrypted message blob is sent to the server and stored in the database.

The decryption key is never stored on the server.

Step 3 – Secure Link

The decryption key is embedded in the URL fragment, for example:

https://example.com/secure-message/abc123#decryptionkey

Everything after the # symbol is never transmitted to the server and only exists in the recipient's browser.

Step 4 – Decryption

When the recipient opens the link:

  1. The browser extracts the key from the URL fragment.
  2. The encrypted message is fetched from the server.
  3. The browser decrypts the message locally.

Step 5 – Cleanup

When the message is read or when it expires, the encrypted data is permanently removed from the database.

5. Configuration

All settings are available under: Secure Messages → Settings

Default settings

These defaults apply to every new secure message, in the admin area, the customer area and tickets

  • Default Expiration Period: 1 day, 3 days, 7 days, 30 days, or Never
  • Default Self-destruction: Burn after reading (deleted immediately after the first view) or Time-bound only
  • Password required to open message: when enabled, set a default password the recipient must enter before decryption starts

 Customer area

  • Availability in customer area: Disabled, Standalone page, Ticket integration, or Both. With the standalone page enabled, a "Secure Message" item appears in the customer portal menu.
  • After creating (standalone page): choose what happens when a clientcreates a message. Send by email directly emails the secure link to the recipient you configured. Show link to copy shows the link on screen so the client can deliver it themselves.
  • Recipient email addresses (standalone page): one or more email addresses, separated by commas. Add an optional display name per entry as `Name|Dit e-mailadres wordt beveiligd tegen spambots. JavaScript dient ingeschakeld te zijn om het te bekijken.` (names cannot contain commas). With a single address the client sees it as a fixed recipient; with multiple addresses the client picks the recipient from a list. The email is only ever sent to an address from this list.

Per-option controls

For the password, the expiration period and the self-destruction you decide per option who is in control, separately for the customer area page and for the secure message box on tickets:

  • Sender chooses: the sender picks the value in the form
  • Use default and show: your default is applied and shown to the sender
  • Use default and hide: your default is applied silently

For tickets, the password option has an extra choice, No password (the default), so emailed links keep working without the recipient needing a password. When the sender sets a password themselves, it is their own password; the shared default password is never shown in the customer area.

Cronjob Integration

No additional configuration is required.

The module automatically hooks into the Perfex CRM Cronjob system using the after_cron_run action to perform cleanup tasks.

6. Customer Area

With the standalone page enabled, clients find a "Secure Message" item in the customer portal menu. The form always shows who will receive the message before it is created. Depending on your per-option settings, the client can also set a reference, the expiration period, the self-destruction behaviour and a password.

After creating the message, the secure link is either emailed directly to the configured recipient or shown on screen with instructions to copy and deliver it, depending on the "After creating" setting. In both cases the message itself is encrypted in the client's browser and never leaves it unencrypted.

 7. Secure Messages in Tickets

With ticket integration enabled, a "Send secure message" button appears on the ticket detail page, for staff in the admin area and for clients in the customer portal. The sender types the sensitive text in a separate box; it is encrypted in the browser and the secure link is emailed directly to the other party. Nothing confidential is posted in the ticket thread.

  • Recipient resolution: staff messages go to the ticket contact. Client messages go to the assigned staff member, or to the department email address when no one is assigned. If neither can be resolved, the button is not shown.
  • Visible record: every send adds a line to the ticket conversation ("X sent a secure message to Y."), so there is a permanent record that a secure note was exchanged, even after the message expires. The line never contains the link or the content.
  • Reference: ticket messages show the ticket number and subject as their reference in the admin overview.

8. Notification Email

The email that delivers the secure link uses a dedicated, editable template under Setup → Email Templates ("Secure Message Link"), available in every bundled language. You can use the merge fields `{sender_name}`, `{secure_message_link}` and `{ticket_reference}`. The email is sent immediately and is never stored in the email queue, so the link (which contains the decryption key) never sits in your database.

9. Changelog

Version 1.2.0 – July 2026:

Customer area support: clients create secure messages from the portal, via a standalone page or directly from tickets.
Configurable recipient list with optional display names, per-option controls for password, expiration and self-destruction, a visible record line in the ticket conversation, ticket references in the admin overview, and an editable notification email template. Fully translated in all bundled languages.

Version 1.1.0 – April 2026:

No more CDN assets, strict-mode JavaScript,
improved styling, admin settings groups and an uninstall script.

Version 1.0.0 – March 2026

Initial release.

Features include:

  • Client-side AES-256 encryption
  • Zero-Knowledge architecture
  • Burn-after-reading secure messages
  • Automatic Cronjob cleanup for expired messages
  • Support for 20+ languages, including:
    • Brazilian Portuguese
    • Bulgarian
    • Canadian French
    • Catalan
    • Chinese
    • Czech
    • Dutch
    • English
    • Finnish
    • French
    • German
    • Greek
    • Indonesia
    • Italian
    • Japanese
    • Norwegian
    • Persian
    • Polish
    • Portuguese
    • Romanian
    • Russian
    • Slovak
    • Spanish
    • Swedish
    • Turkish
    • Ukrainian
    • Vietnamese

7. Support

If you encounter any issues or need help with installation, configuration, or usage, please contact:

Dit e-mailadres wordt beveiligd tegen spambots. JavaScript dient ingeschakeld te zijn om het te bekijken.

Table of content