• Connection to your Dynamics CRM Application Server is locked to IP address and secured by HTTPS. If you are using Dynamics 365 Online with Azure AD then you can still benefit from IP based restrictions as described here.
• A limited number of SDK calls (see the full list here) are made to read and write data using a single Vuture account - we don't need any other user's Dynamics CRM password
• You can add an extra layer of security by having IIS/Windows NTLM authentication as well as Dynamics CRM user authentication
• Your Data Change Management (DCM) rules are respected
• Data being written to Dynamics CRM is managed through a queue which can throttle the number of requests being made and can retry or pause data transfer in the event that Dynamics CRM is not available or busy
• Vuture only retrieves data from Dynamics CRM as it is needed
• Basic list data is loaded to send out marketing campaigns, all other data is loaded for each campaign recipient as requested

See also this article here