​

Customer Responsibilities

​

Shared Responsibility Model

┌─────────────────────────────────────────────────────────────┐
│                     CUSTOMER RESPONSIBILITY                  │
│  • User management      • Access control configuration      │
│  • Data classification  • Compliance with regulations       │
│  • Application security • Incident response                 │
├─────────────────────────────────────────────────────────────┤
│                     SHARED RESPONSIBILITY                    │
│  • Security configuration  • Monitoring and alerting        │
│  • Identity management     • Vulnerability management       │
├─────────────────────────────────────────────────────────────┤
│                      CREW RESPONSIBILITY                     │
│  • Infrastructure security  • Platform availability         │
│  • Encryption services      • Physical security             │
│  • Network security         • Security updates              │
└─────────────────────────────────────────────────────────────┘

​

Account Security

​

Credential Management

• Securing API keys — Never expose in client-side code or public repositories
• Rotating credentials — Change API keys regularly (recommended: 90 days)
• Limiting access — Use scoped API keys with minimal permissions
• Password policies — Enforce strong passwords for team members
• MFA enrollment — Enable MFA for all users (required for Enterprise)

​

Best Practices

// Good: Scoped API key with specific permissions
{
  "name": "Analytics Dashboard",
  "permissions": ["calls:read", "analytics:read"]
}

// Bad: Full access key used everywhere
{
  "name": "Main Key",
  "permissions": ["*"]
}

​

Credential Compromise

1. Immediately revoke the affected credentials
2. Generate new credentials
3. Update all applications using those credentials
4. Review audit logs for unauthorized access
5. Report to security@usecrew.ai if Crew systems may be affected

​

Access Control

​

User Management

• Adding users appropriately with correct roles
• Removing users promptly when they leave
• Regular access reviews (recommended: quarterly)
• Role assignment based on job requirements

​

Role Assignment Guidelines

​

Separation of Duties

• Production vs. development access
• Configuration vs. monitoring access
• Data access vs. administrative access

​

Data Protection

​

Classification

​

Retention Configuration

{
  "retention": {
    "transcripts_days": 90,    // Your compliance requirement
    "recordings_days": 30,     // Your compliance requirement
    "call_metadata_days": 365  // Your compliance requirement
  }
}

​

PII Considerations

• Configure PII redaction
• Set appropriate retention
• Document data flows
• Honor data subject requests

​

Compliance

​

Regulatory Compliance

• Determining applicable regulations (HIPAA, GDPR, CCPA, etc.)
• Configuring Crew to meet those requirements
• Maintaining required documentation
• Conducting required assessments

​

Documentation

• Security configurations
• Access control decisions
• Data processing activities
• Vendor assessments (including Crew)

​

Auditing

• User access and roles
• API key usage
• Audit logs
• Security settings

​

Integration Security

​

Webhook Security

// Always verify signatures
function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return `sha256=${expected}` === signature;
}

​

API Integration

• Use HTTPS only
• Validate all responses
• Handle errors gracefully
• Don’t log sensitive data

​

Third-Party Integrations

• Assess security of connected systems
• Use minimal required permissions
• Encrypt stored credentials
• Monitor integration access

​

Monitoring and Response

​

Audit Log Review

• Unexpected access patterns
• Failed authentication attempts
• Configuration changes
• Data export activities

​

Alerting

• Multiple failed login attempts
• Access from unusual locations
• Large data exports
• Configuration changes

​

Incident Response

1. Detection — How you’ll identify security incidents
2. Response — Immediate actions to contain impact
3. Communication — Who to notify (including Crew if relevant)
4. Recovery — Restoring normal operations
5. Post-incident — Analysis and improvement

​

Application Security

​

Custom Integrations

• Follow secure coding practices
• Validate all inputs
• Handle credentials securely
• Keep dependencies updated

​

Code Node Security

• Don’t hardcode credentials (use secrets)
• Validate external API responses
• Handle errors appropriately
• Don’t log sensitive data

// Good: Use secrets
const apiKey = secrets.EXTERNAL_API_KEY;

// Bad: Hardcoded
const apiKey = 'sk-1234567890abcdef';

​

Training

​

Team Training

• How to access Crew securely
• Data handling requirements
• Incident reporting procedures
• Their specific responsibilities

​

Documentation

• Access request procedures
• Secure configuration standards
• Incident response playbooks
• Compliance requirements

​

Reporting Security Issues

​

To Crew

• Email: security@usecrew.ai
• Priority: Include severity assessment
• Details: Provide reproduction steps if applicable

​

Internal Reporting

• Reporting suspected incidents
• Escalation paths
• Documentation requirements

​

Checklist

​

Support

• General security: security@usecrew.ai
• Compliance questions: compliance@usecrew.ai
• Enterprise support: Your dedicated contact

​

Next Steps

• Security Overview — Platform security details
• Data Handling — Data processing information
• Healthcare Readiness — Healthcare considerations