Security Overview
Crew is built with a security-first architecture designed to protect your data and your customers’ information. This page provides an overview of our security practices, certifications, and architecture.Security Principles
Our approach to security is guided by:- Defense in Depth — Multiple layers of security controls
- Least Privilege — Minimal access required for any operation
- Encryption Everywhere — Data protected in transit and at rest
- Continuous Monitoring — Real-time threat detection and response
- Transparency — Clear documentation of security practices
Infrastructure
Cloud Architecture
Crew runs on enterprise-grade cloud infrastructure:| Component | Provider | Region Options |
|---|---|---|
| Application | Vercel | US, EU |
| Database | Supabase (PostgreSQL) | US, EU |
| Telephony | Twilio | Global |
| AI Processing | OpenAI | US |
Network Security
- TLS 1.2+ for all connections
- Web Application Firewall (WAF) protection
- DDoS mitigation at network edge
- Private networking between services
- Regular penetration testing
Access Control
- Role-based access control (RBAC) for all resources
- Multi-factor authentication (MFA) support
- Single Sign-On (SSO) for Enterprise plans
- API key scoping with minimal permissions
- Audit logging for all access events
Data Encryption
In Transit
All data is encrypted during transmission:- TLS 1.2 or higher for HTTPS connections
- Certificate pinning for mobile applications
- Perfect Forward Secrecy (PFS) enabled
- HSTS enforced on all endpoints
At Rest
Stored data is encrypted:- AES-256 encryption for database fields
- Encrypted backups with separate key management
- Encrypted file storage for recordings and documents
- Hardware Security Modules (HSM) for key management
Key Management
- Keys stored in dedicated key management service
- Automatic key rotation
- Separation of keys by tenant
- Access logging for all key operations
Authentication & Authorization
User Authentication
- Password hashing with bcrypt
- Configurable password policies
- Session management with secure tokens
- Brute force protection with rate limiting
- Optional MFA via authenticator apps
API Authentication
- API keys for server-to-server
- JWT tokens for user-scoped access
- OAuth 2.0 for third-party integrations
- IP allowlisting available
- Automatic token expiration
Authorization
Application Security
Secure Development
- Security-focused code review process
- Automated vulnerability scanning (SAST/DAST)
- Dependency vulnerability monitoring
- Regular security training for developers
- Bug bounty program (coming soon)
Input Validation
- Server-side validation for all inputs
- Parameterized queries (SQL injection prevention)
- Content Security Policy (CSP) headers
- Cross-Site Scripting (XSS) protection
- Cross-Site Request Forgery (CSRF) tokens
Third-Party Security
- Vendor security assessments
- Minimal third-party dependencies
- Regular dependency updates
- Supply chain security monitoring
Operational Security
Monitoring
- 24/7 infrastructure monitoring
- Real-time security alerting
- Log aggregation and analysis
- Anomaly detection
Incident Response
Documented incident response procedures:- Detection — Automated and manual monitoring
- Triage — Severity assessment and escalation
- Containment — Isolate affected systems
- Eradication — Remove threat
- Recovery — Restore services
- Post-Mortem — Analysis and improvement
Business Continuity
- Geographic redundancy across availability zones
- Automated failover for critical services
- Regular backup testing
- Disaster recovery procedures
- 99.9% uptime SLA (Enterprise)
Compliance Framework
Current Status
| Framework | Status |
|---|---|
| SOC 2 Type II | In Progress |
| GDPR | Compliant |
| CCPA | Compliant |
| PCI DSS | Not applicable (no card storage) |
| HIPAA | See Healthcare Readiness |
Data Processing
- Data Processing Agreement (DPA) available
- Standard Contractual Clauses for EU transfers
- Privacy policy publicly available
- Cookie consent management
Security Reporting
Vulnerability Disclosure
If you discover a security vulnerability:- Email security@usecrew.ai
- Include detailed reproduction steps
- Allow 90 days for remediation before disclosure
- We do not pursue legal action for good-faith reports
Security Updates
- Security advisories published at
/security/advisories - Critical updates communicated via email
- Status page at
status.usecrew.ai
Customer Responsibilities
Security is a shared responsibility. Customers are responsible for:- Securing API keys and credentials
- Managing user access within their workspace
- Configuring appropriate permissions
- Reviewing audit logs
- Reporting suspected security issues
Questions
For security questions or to request additional documentation:- Email: security@usecrew.ai
- Enterprise Security Review: Contact sales@usecrew.ai
Next Steps
- Data Handling — How we process and store data
- Healthcare Readiness — Healthcare-specific considerations
- Customer Responsibilities — Your role in security