Platform & Integrations · Platform
Security designed in, not added later
CrewFlow holds passports, right-to-work evidence, pay rates and bank details. Every table is protected by database-level row security scoped to your organisation, every change is written to an append-only audit log, and every file lives in private, tenant-isolated storage.
Why it matters
The case for Security
In labour supply, the data is the risk. Isolation enforced at the database is the only model that survives an application bug.
row-level
isolation
Tenant separation is enforced by the database on every single query.
POST /v1/jobs
Authorization: Bearer <api-key>
{
"project_id": "prj_8fa2",
"start_date": "2026-04-06",
"roles": [{ "trade": "pipefitter", "headcount": 8 }]
}
→ 201 { "job_id": "job_2c19", "status": "mobilising" }Capabilities
What Security does
Database-enforced isolation
Row-level security scopes every query to your organisation — not application code that could be bypassed.
Role-based access
Separate roles for administrators, office staff, clients and workers, with least privilege by default.
Immutable audit log
Database triggers record who changed what, when, and from where.
Encrypted storage
Private buckets with signed, expiring access and strict per-organisation paths.
How it works
The workflow, end to end
- Step 01
Authenticate
Sign in with email, Google or your enterprise identity provider.
- Step 02
Authorise
Roles and organisation membership determine what is visible.
- Step 03
Act
Every read and write is checked at the database.
- Step 04
Audit
Changes are recorded permanently and are searchable.
Benefits
What your team gets
- Cross-tenant access is structurally impossible
- Security questionnaires answered with evidence
- Incidents investigable to the row
- GDPR obligations supported by design
Outcomes
What changes in your operation
- Structural isolation
- Evidence-based assurance
- GDPR support
FAQ
Security questions we are asked most
Explore next
Works closely with
- Trust CentreHosting, subprocessors, retention, GDPR rights and platform status.
- ComplianceDocuments, expiries, right to work and client requirements, continuously checked.
- Developer APIA versioned REST API with OpenAPI docs, OAuth and API keys.
- Enterprise ReadinessSSO, roles, seat management, impersonation controls and rollout support.