> ## Documentation Index > Fetch the complete documentation index at: https://docs.usecrew.ai/llms.txt > Use this file to discover all available pages before exploring further. # Customer Responsibilities > Your role in maintaining security when using Crew # Customer Responsibilities Security is a shared responsibility between Crew and our customers. While we provide a secure platform, you are responsible for how you configure and use the service. This page outlines your key responsibilities. ## Shared Responsibility Model ``` ┌─────────────────────────────────────────────────────────────┐ │ CUSTOMER RESPONSIBILITY │ │ • User management • Access control configuration │ │ • Data classification • Compliance with regulations │ │ • Application security • Incident response │ ├─────────────────────────────────────────────────────────────┤ │ SHARED RESPONSIBILITY │ │ • Security configuration • Monitoring and alerting │ │ • Identity management • Vulnerability management │ ├─────────────────────────────────────────────────────────────┤ │ CREW RESPONSIBILITY │ │ • Infrastructure security • Platform availability │ │ • Encryption services • Physical security │ │ • Network security • Security updates │ └─────────────────────────────────────────────────────────────┘ ``` ## Account Security ### Credential Management You are responsible for: * **Securing API keys** — Never expose in client-side code or public repositories * **Rotating credentials** — Change API keys regularly (recommended: 90 days) * **Limiting access** — Use scoped API keys with minimal permissions * **Password policies** — Enforce strong passwords for team members * **MFA enrollment** — Enable MFA for all users (required for Enterprise) ### Best Practices ```json theme={null} // Good: Scoped API key with specific permissions { "name": "Analytics Dashboard", "permissions": ["calls:read", "analytics:read"] } // Bad: Full access key used everywhere { "name": "Main Key", "permissions": ["*"] } ``` ### Credential Compromise If you suspect credentials are compromised: 1. Immediately revoke the affected credentials 2. Generate new credentials 3. Update all applications using those credentials 4. Review audit logs for unauthorized access 5. Report to [security@usecrew.ai](mailto:security@usecrew.ai) if Crew systems may be affected ## Access Control ### User Management You are responsible for: * **Adding users** appropriately with correct roles * **Removing users** promptly when they leave * **Regular access reviews** (recommended: quarterly) * **Role assignment** based on job requirements ### Role Assignment Guidelines | Role | Should Have | Examples | | ------ | ------------------------ | ------------------------------ | | Owner | Critical operations only | Account deletion, billing | | Admin | Day-to-day management | Agent config, user management | | Member | Operational tasks | Call review, knowledge updates | | Viewer | Read-only needs | Analytics, monitoring | ### Separation of Duties Consider separating: * Production vs. development access * Configuration vs. monitoring access * Data access vs. administrative access ## Data Protection ### Classification You are responsible for understanding what data flows through Crew: | Data Type | Your Classification | Handling Requirements | | -------------- | ------------------- | --------------------- | | Customer calls | Your determination | Based on industry | | Transcripts | Your determination | Based on content | | Recordings | Your determination | Based on regulations | ### Retention Configuration Set appropriate retention periods: ```json theme={null} { "retention": { "transcripts_days": 90, // Your compliance requirement "recordings_days": 30, // Your compliance requirement "call_metadata_days": 365 // Your compliance requirement } } ``` ### PII Considerations If handling PII: * Configure PII redaction * Set appropriate retention * Document data flows * Honor data subject requests ## Compliance ### Regulatory Compliance You are responsible for: * Determining applicable regulations (HIPAA, GDPR, CCPA, etc.) * Configuring Crew to meet those requirements * Maintaining required documentation * Conducting required assessments ### Documentation Maintain records of: * Security configurations * Access control decisions * Data processing activities * Vendor assessments (including Crew) ### Auditing Regularly review: * User access and roles * API key usage * Audit logs * Security settings ## Integration Security ### Webhook Security When receiving webhooks: ```javascript theme={null} // Always verify signatures function verifyWebhook(payload, signature, secret) { const expected = crypto .createHmac('sha256', secret) .update(payload) .digest('hex'); return `sha256=${expected}` === signature; } ``` ### API Integration When integrating with Crew: * Use HTTPS only * Validate all responses * Handle errors gracefully * Don't log sensitive data ### Third-Party Integrations When connecting external systems: * Assess security of connected systems * Use minimal required permissions * Encrypt stored credentials * Monitor integration access ## Monitoring and Response ### Audit Log Review Regularly review audit logs for: * Unexpected access patterns * Failed authentication attempts * Configuration changes * Data export activities ### Alerting Configure alerts for: * Multiple failed login attempts * Access from unusual locations * Large data exports * Configuration changes ### Incident Response Develop procedures for: 1. **Detection** — How you'll identify security incidents 2. **Response** — Immediate actions to contain impact 3. **Communication** — Who to notify (including Crew if relevant) 4. **Recovery** — Restoring normal operations 5. **Post-incident** — Analysis and improvement ## Application Security ### Custom Integrations If building integrations: * Follow secure coding practices * Validate all inputs * Handle credentials securely * Keep dependencies updated ### Code Node Security When using Custom Code Nodes: * Don't hardcode credentials (use secrets) * Validate external API responses * Handle errors appropriately * Don't log sensitive data ```javascript theme={null} // Good: Use secrets const apiKey = secrets.EXTERNAL_API_KEY; // Bad: Hardcoded const apiKey = 'sk-1234567890abcdef'; ``` ## Training ### Team Training Ensure team members understand: * How to access Crew securely * Data handling requirements * Incident reporting procedures * Their specific responsibilities ### Documentation Maintain internal documentation for: * Access request procedures * Secure configuration standards * Incident response playbooks * Compliance requirements ## Reporting Security Issues ### To Crew Report security concerns to: * **Email**: [security@usecrew.ai](mailto:security@usecrew.ai) * **Priority**: Include severity assessment * **Details**: Provide reproduction steps if applicable ### Internal Reporting Establish internal procedures for: * Reporting suspected incidents * Escalation paths * Documentation requirements ## Checklist Use this checklist for security reviews: * [ ] API keys stored securely (not in code) * [ ] API keys scoped to minimal permissions * [ ] Keys rotated within 90 days * [ ] Unused keys revoked * [ ] All users have appropriate roles * [ ] No shared accounts * [ ] MFA enabled for all users * [ ] Recent access review completed * [ ] Retention periods configured * [ ] PII handling configured * [ ] Recording settings appropriate * [ ] Data classification documented * [ ] Audit logs reviewed recently * [ ] Alerts configured * [ ] Incident response plan exists * [ ] Contact information current * [ ] Webhook signatures verified * [ ] External system security assessed * [ ] Integration credentials secured * [ ] Minimal permissions granted ## Support For security-related questions: * **General security**: [security@usecrew.ai](mailto:security@usecrew.ai) * **Compliance questions**: [compliance@usecrew.ai](mailto:compliance@usecrew.ai) * **Enterprise support**: Your dedicated contact ## Next Steps * [Security Overview](/security/overview) — Platform security details * [Data Handling](/security/data-handling) — Data processing information * [Healthcare Readiness](/security/healthcare-readiness) — Healthcare considerations