Security and incident response
CrowdSafeData uses layered controls for identity, tenant isolation, ingestion integrity, auditability and recoverability.
Effective August 16, 2026 · Version 1.1Security architecture
Google or verified-email authentication through Firebase, followed by short-lived, signed, HttpOnly CrowdSafeData sessions.
Organization-scoped records with owner, administrator, analyst and viewer roles.
Allowed formats, bounded-memory transfer parts, daily and storage limits, secure filenames, streaming server verification and SHA-256 manifests.
Structured records in tenant-scoped database tables and source objects in protected object storage.
Audit events, explicit mapping confidence and protected analytical limits.
Security headers, no-store responses, input validation and signed billing webhooks.
Versioned recovery snapshots with integrity hashes and a documented retention schedule.
Deep health checks, hosted runtime logs, request diagnostics and a public service-status surface.
Incident response process
- Triage: validate the report, affected organization, time window and data category.
- Contain: restrict affected access, preserve evidence and limit further exposure.
- Assess: determine scope, root cause, legal obligations and operational impact.
- Notify: contact affected customers without undue delay when a confirmed incident requires notice.
- Recover: restore validated service state, monitor recurrence and document decisions.
- Improve: complete a post-incident review and track corrective actions.
Reporting a concern
Open a Security case through the Account and Support console. Include the organization, time observed, affected feature, evidence available and a safe callback method. Do not include passwords, secret keys or unnecessary personal data. CrowdSafeData support is not an emergency dispatch channel.
Service providers
Core service providers are disclosed in the Privacy Policy and DPA. OpenAI Sites and Cloudflare services support site delivery, the hosted runtime and protected storage. Google Firebase provides authentication. PayPal or Stripe processes billing only when the applicable method is activated.
Responsible testing
Do not perform disruptive testing, social engineering, denial-of-service activity, automated account creation or access to another organization. Report suspected vulnerabilities through the Security support category so written authorization and a safe testing scope can be established.