Security

1. Security approach

Crewyard is designed for small home-service shops managing bookings, dispatch, quotes, invoicing, and review replies. We aim to use reasonable safeguards appropriate to the service and the information it handles. The specific safeguards may evolve as the product, vendors, and operating environment change.

Crewyard is not claiming SOC 2, ISO 27001, PCI DSS, HIPAA, or any other certification or compliance status through this page. Customers should evaluate whether the service fits their own legal, contractual, insurance, and security requirements.

2. Data handling

We limit access to business and customer information to what is needed to operate, support, secure, and improve Crewyard. Information may be processed by infrastructure and service providers that help deliver hosting, authentication, analytics, communications, backups, and AI-assisted features. Access and processing depend on the feature a shop uses and the configuration in place at that time.

AI-assisted workflows may send relevant inputs to an AI processing provider to return a requested draft, suggestion, summary, or classification. Shops should avoid entering sensitive information that is not necessary for the task and should review the privacy terms and configuration applicable to their use.

3. Tenant and access controls

Crewyard uses account and authorization boundaries intended to keep one shop’s workspace separate from another’s. Users should receive only the access appropriate for their responsibilities. We may log authentication and security-relevant activity to investigate misuse and protect the service. No access-control design is perfect, so customers should report unexpected access promptly.

4. Encryption and transport

Network connections to Crewyard are intended to use modern encrypted transport where supported by the service and hosting environment. Data may also be protected by encryption or access controls provided by our infrastructure and service providers. The exact implementation can vary by system, and this page should not be read as a guarantee that every data path or customer-controlled integration has the same protection.

5. Monitoring and backups

We may monitor service health, application errors, authentication events, and other operational signals to help detect problems and investigate incidents. Backups may be used to support recovery and continuity. Monitoring and backup coverage is not necessarily uniform across every feature, integration, or historical record, and customers should maintain their own copies of information they need to retain.

6. Incident response

If we become aware of a security incident that affects customer information, we will assess it and take steps we consider appropriate, which may include containment, remediation, and notice where required by law or agreement. A notice may describe what we know at the time and may be updated as the investigation develops.

7. Customer security responsibilities

Customers help protect their Crewyard workspace by:

• Using strong, unique passwords and keeping credentials and recovery methods private.
• Reviewing users and permissions regularly and removing access that is no longer needed.
• Keeping devices, browsers, integrations, and staff access practices reasonably secure.
• Confirming customer consent and legal permissions before sending messages or processing customer information.
• Reviewing AI output and operational details before relying on, sending, or publishing them.
• Reporting suspicious activity or unauthorized access as soon as possible.

8. Responsible disclosure

If you believe you found a security issue in Crewyard, please contact us promptly with the affected area, a description of the issue, steps to reproduce it, and any relevant evidence. Please avoid accessing, changing, or downloading other users’ data, disrupting the service, or publicly disclosing the issue while we investigate.

9. Contact

Security questions and responsible-disclosure reports can be sent to crewyard-k5bzp9@polsia.app. Please do not include passwords, API keys, or unnecessary customer information in your first message.