Trust Centre
Workforce data deserves more than a promise
CrewFlow holds passports, certificates, pay data and client commercials. Security is enforced in the database and infrastructure, not only in application code.
GDPR & data protection
CrewFlow is built for European workforce data, where personal and identity documents are unavoidable.
- Lawful basis and retention documented
- Data subject export and erasure tooling
- Data Processing Agreement available
- Sub-processor transparency
Encryption
Data is encrypted in transit and at rest across the platform.
- TLS 1.2+ everywhere
- Encryption at rest for database and storage
- Secrets held in managed secret storage
- Signed, expiring document URLs
Audit logging
Auditing is enforced at the database level, not in application code that can be bypassed.
- Row-change triggers on tenant tables
- Actor, timestamp and diff retained
- Document hashes for tamper evidence
- Immutable activity history
Role-based access
Access follows role and organisation membership, checked on every request.
- Roles stored separately from profiles
- Least-privilege by default
- Granular API scopes
- Session and token revocation
Multi-tenant security
Organisation isolation is enforced by row-level security in the database.
- Every tenant table carries an organisation key
- Policies evaluated per request
- Organisation keys are immutable
- Storage paths scoped per organisation
API security
The developer platform is built with least privilege and full traceability.
- OAuth 2.0 with PKCE
- Scoped, revocable API keys
- Rate limiting per credential
- Every request logged
Data residency
European hosting by default, with residency discussion available for enterprise agreements.
- EU-hosted infrastructure
- Documented data flows
- Residency options on Enterprise
- No training on customer data
Backups & disaster recovery
Continuous backups with tested restore procedures.
- Automated daily backups
- Point-in-time recovery
- Documented RPO and RTO targets
- Restore rehearsals
Compliance & status
Ongoing assurance work, with operational transparency.
- Security review programme
- Vulnerability disclosure process
- Dependency scanning
- Operational status reporting
Documentation
The detail your security team will ask for
Architecture, testing, data processing, infrastructure and recovery — written plainly, with the signed documents available on request.
Architecture overview
How CrewFlow is built, where each tier runs and how tenants are kept apart.
- A React and TanStack Start application served from the edge, with all privileged logic executed in server functions.
- A Postgres database where every tenant table carries an organisation identifier and row level security enforces the boundary.
- Background workers for AI extraction, automations and webhook delivery, each leased and retried independently.
- Object storage partitioned by organisation, with signed, short-lived URLs for every download.
Security whitepaper
On requestControls, threat model and the reasoning behind our isolation design.
- Defence in depth: authentication, role-based authorisation, row level security and immutable organisation identifiers.
- Least privilege for every service role; privileged database access is never reachable from browser code.
- Secrets held in managed secret storage and injected at request time, never bundled into client code.
- The full whitepaper is shared under NDA with prospective and existing customers.
Penetration testing
On requestIndependent testing cadence, scope and how findings are handled.
- Annual third-party penetration test covering the application, API and tenant isolation boundary.
- Targeted retesting after any significant change to authentication or the data access layer.
- Findings triaged by severity with remediation targets; critical issues are fixed before release.
- A summary letter is available to customers and prospects on request.
Data processing
What we process, why, for how long, and who else is involved.
- CrewFlow acts as processor for the workforce data your organisation controls.
- Categories processed: identity and right-to-work documents, qualifications, assignments, hours, expenses and pay-relevant data.
- Retention follows your configured policy; deletion requests are honoured across primary storage and backups on schedule.
- Our Data Processing Agreement and current sub-processor list are published and versioned.
Infrastructure
Where CrewFlow runs and how the platform is operated.
- Managed European infrastructure with encryption in transit (TLS 1.2+) and at rest.
- Environment separation between production, preview and sandbox; sandbox data is synthetic.
- Change management through reviewed, versioned database migrations — no ad-hoc production schema edits.
- Operational telemetry and error reporting with alerting on processing failures.
Disaster recovery
Backups, restore testing and our recovery objectives.
- Daily backups plus point-in-time recovery for the primary database.
- Documented restore runbook, exercised on a recurring schedule against a clean environment.
- Recovery objectives are agreed contractually for Enterprise customers.
- Object storage is redundantly stored within the same data region.
Business continuity
How service continues when something goes wrong.
- Incident response with defined severity levels, ownership and customer communication paths.
- Status page updates for any customer-affecting incident, with a post-incident summary.
- Background processing is queue-based and resumes automatically after an outage — no work is silently lost.
- Data export is always available to customers, so you are never locked in.
Operational status
Transparency when something goes wrong
We publish operational status and communicate incidents to affected customers. Security issues can be reported to our disclosure address and are triaged the same working day.
- Platform status
- Live component health and incident history on our status page.
- Backups
- Daily backups plus point-in-time recovery, with restores exercised on a schedule.
- Data region
- European Union, encrypted in transit and at rest.
- Disclosure
- security@crewflow.app — triaged the same working day.