Security & Trust
Last updated: [[date]]
Crewzy holds sensitive people data — identities, pay, documents and compliance records — so security isn't a feature, it's the foundation. Here's how the platform is built to protect it.
Tenant isolation
Every company is a separate tenant. Data is partitioned by company and access is scoped to the tenant on every request, so one customer can never see another's data.
Role-based access control
Access follows least-privilege. Permissions are granted per role (Owner, Admin, HR Manager, Manager, Employee) and enforced on every endpoint and on individual records — an employee only ever sees what their role allows.
Separation of duties (maker-checker)
Sensitive approvals are segregated: the person who submits a timesheet, leave request or expense cannot be the one who approves it. This maker-checker control is enforced across the platform.
Full audit trail
Every meaningful action is recorded — who did what, when, and from where — giving you a complete, tamper-evident history for reviews, investigations and compliance.
Encryption
Data is encrypted in transit (TLS) and at rest (AES-256), including documents and receipts stored in Amazon S3, which are only ever served through short-lived, signed links.
Authentication
Sign-in is protected by verified email, securely hashed passwords and optional multi-factor authentication. Sessions use short-lived, signed tokens.
Compliance-by-design
Document expiry is tracked so certifications and permits never lapse silently, and the controls above map to what auditors expect.
Infrastructure
Crewzy runs on Amazon Web Services (region: eu-west-2), with hardened service-to-service authentication between internal components.
Compliance posture
Crewzy is built to SOC 2 and ISO 27001 principles and aligned with GDPR. Formal certification status: [[in progress / planned — state honestly; do not claim a certification you don't hold]]. See our Privacy Policy for how we handle personal data.
Reporting a vulnerability
Found a security issue? We want to hear from you. Please report it to [[security@crewzy.io]] and we'll respond promptly.