Security overview

Security is foundational to how we build and operate Crewstro. This overview describes the practices we use to help protect your data. It is intended as a general summary; specific controls and certifications should be confirmed with your security team.

1. Our approach

We take a layered, defense-in-depth approach to security, combining technical controls, operational processes, and ongoing review. Security considerations are built into our development and operations rather than added afterward.

2. Encryption

• In transit: data is encrypted using industry-standard TLS.
• At rest: stored data is encrypted using strong, widely adopted algorithms.
• Secrets: credentials and keys are managed with restricted access.

3. Infrastructure

The Service runs on reputable cloud infrastructure providers that maintain robust physical and environmental security controls. Environments are logically separated, and production access is limited.

4. Access control

• Access to systems follows the principle of least privilege.
• Administrative access requires strong authentication.
• Access is reviewed periodically and revoked when no longer needed.

5. Monitoring & logging

We log relevant system activity and monitor for anomalous behavior. Logs help us investigate issues and support the integrity of the Service.

6. Backups & continuity

We perform regular backups and maintain processes intended to support recovery in the event of a disruption. Recovery objectives should be confirmed against your specific requirements.

7. Vendor management

We evaluate the security practices of third-party providers that process data on our behalf and put appropriate agreements and safeguards in place.

8. Incident response

We maintain procedures to detect, investigate, and respond to security incidents. Where required by law or contract, we will notify affected parties of incidents that materially affect their data.

9. Your responsibilities

Security is a shared responsibility. You can help protect your account by using strong, unique passwords, enabling available security features, limiting access to authorized team members, and keeping your devices secure.

10. Reporting a vulnerability

If you believe you have found a security vulnerability, we encourage you to report it to us promptly and responsibly. Please contact us using the details below and allow us reasonable time to investigate and remediate before public disclosure.

11. Contact

Security questions and reports can be sent to hi@crewstro.com or through our contact page.