Security
How we protect your data
Crewnyx holds your crew's hours, pay details and receipts, and the addresses of the places you work. This page says plainly what we do to keep that safe. It leaves out the technical detail of how our systems are built, because that would help an attacker more than it helps you.
1. Encryption
- In transit. Everything sent between your browser or phone and Crewnyx is encrypted.
- At rest. Everything we store is encrypted at rest.
- Connected accounts. Most of the passwords and access keys you give us to connect other services are encrypted a second time before we store them.
- Your password. It is never stored in a form anyone can read back, including us.
2. Keeping companies apart
Crewnyx serves many companies, and each company's records are kept separate from every other company's. An automated check runs every night to confirm that no company can see another company's data.
Inside your company, each person's role decides what they can see and change. Wages and job labor costs are shown to the owner and the accountant only.
3. Where your data is kept
Crewnyx is run from the United States, and your company's records are stored there. Off-site backup copies are encrypted before they leave our systems, and they're kept in the United States too. The privacy policy lists the service providers we use and where each one is.
4. What we don't do with it
- We don't sell personal information.
- We don't use your company's records to train generative AI or machine-learning models.
5. Location
- A phone's location is recorded only while that person is on the clock, and only with the phone's permission: when they clock in and out, and every so often while a shift or job visit is open. It stops when they clock out.
- Those location points are kept for 90 days.
- A vehicle tracker your company connects records the vehicle, not anyone's phone: where it is as often as once a minute, at any hour it's driven. Vehicle positions are kept for 30 days.
6. Signing in
- Everyone at your company signs in with two-factor authentication: a password plus a code from an authenticator app. Anyone who hasn't set it up is asked to before they can continue.
- Crewnyx's sign-in locks an account for a while after repeated wrong passwords or codes.
7. Payments
Payments are handled by Stripe, a PCI DSS Level 1 payment processor. You enter your card on Stripe's own pages, so card numbers never reach our servers. We store the references Stripe gives us for your customer record and subscription, not your card.
8. Audits
Crewnyx itself is not SOC 2 audited. The providers we build on for hosting and payments are independently audited, including to SOC 2.
If your company needs answers for a security review, email support@crewnyx.com.
9. If something goes wrong
If a security breach affects your company's personal data, we will tell you without undue delay, and within 72 hours of becoming aware of it, as our Data Processing Addendum requires.
10. Report a vulnerability
If you think you've found a security problem in Crewnyx, email support@crewnyx.com with the subject Security. Tell us what you found, where, and how to reproduce it.
We'll confirm we've received it and keep you updated until it's fixed. We won't take legal action against anyone who reports a problem in good faith and follows these guidelines:
- Don't access, change or delete data that isn't yours, and stop as soon as you've shown the problem.
- Don't disrupt the service: no denial-of-service attacks, spam or automated flooding.
- No social engineering of our customers or of us, and no physical attacks.
- Give us a reasonable time to fix it before telling anyone else.
Get your crew in early.
Tell us about your crew and you'll hear first when Crewnyx opens. No card, nothing to pay.