How we protect your data
Crewnyx holds your crew's hours, pay details and receipts, and the addresses of the places you work. This page says plainly what we do to keep that safe. It leaves out the technical detail of how our systems are built, because that would help an attacker more than it helps you.
1. Encryption
- In transit. Everything sent between your browser or phone and Crewnyx is encrypted with TLS.
- At rest. Your data is encrypted at rest by our hosting and database providers.
- Connected accounts. Most of the passwords and access tokens you give us to connect other services are encrypted again, with AES-256-GCM, before we store them.
- Your password. It is stored only as a salted hash, never in a form anyone can read back.
2. Keeping companies apart
Crewnyx serves many companies, and each company's records are separated inside the database itself. An automated test runs every night to check that one company cannot read another company's data.
Inside your company, each person's role decides what they can see and change.
3. Signing in
- Everyone at your company signs in with two-factor authentication: a password plus a code from an authenticator app. Anyone who hasn't set it up is asked to before they can continue.
- Crewnyx's sign-in locks an account for a while after repeated wrong passwords or codes.
4. Payments
Payments are handled by Stripe, a PCI DSS Level 1 payment processor. You enter your card on Stripe's own pages, so card numbers never reach our servers. We store the references Stripe gives us for your customer record and subscription, not your card.
5. Audits
Crewnyx itself is not SOC 2 audited. The core infrastructure providers we build on — for hosting, our database and payments — are independently audited, including to SOC 2.
If your company needs answers for a security review, email support@crewnyx.com.
6. If something goes wrong
If a security breach affects your company's personal data, we will tell you without undue delay, and within 72 hours of becoming aware of it, as our Data Processing Addendum requires.
7. Report a vulnerability
If you think you've found a security problem in Crewnyx, email support@crewnyx.com with the subject Security. Tell us what you found, where, and how to reproduce it.
We'll confirm we've received it and keep you updated until it's fixed. We won't take legal action against anyone who reports a problem in good faith and follows these guidelines:
- Don't access, change or delete data that isn't yours, and stop as soon as you've shown the problem.
- Don't disrupt the service: no denial-of-service attacks, spam or automated flooding.
- No social engineering of our customers or of us, and no physical attacks.
- Give us a reasonable time to fix it before telling anyone else.