Your support conversations, customer records, and revenue data are some of the most sensitive information your business holds. This page explains the practical steps we take to keep that data safe, and what you can do on your side to keep your workspace secure.
1. Encryption
In transit
Every connection to CrowdStack is served over HTTPS using TLS. This covers the website, the app, embedded widgets, and the API. Plain HTTP requests are redirected to HTTPS, and we send HSTS headers so modern browsers refuse to connect insecurely.
At rest
Databases, backups, and uploaded files are stored on infrastructure that encrypts data at rest using industry-standard AES-256 encryption. Disks, snapshots, and object storage are all encrypted by default.
2. Passwords and authentication
- Passwords are never stored in plain text. They are hashed with bcrypt, a slow, salted algorithm designed to resist brute-force and rainbow-table attacks.
- Sessions use secure, HTTP-only cookies so session tokens cannot be read by scripts running in the browser.
- Password reset and email verification links are single-use and expire after a short window.
- We never ask for your password by email, chat, or phone.
3. Access control and data isolation
Every record in CrowdStack belongs to a single workspace. All queries are scoped to the workspace of the signed-in user, so one organisation can never read or modify another organisation's data.
Inside a workspace, roles let you control who can manage billing, invite teammates, change settings, or simply work tickets. Invitations are sent to a specific email address and must be accepted before access is granted. Members can be removed instantly, which revokes their access straight away.
4. Infrastructure
- CrowdStack runs on established cloud providers with physically secured data centres, redundant power and networking, and their own independently audited security programmes.
- Production systems are isolated from development and testing environments. Customer data is not used in development.
- Secrets and API keys are stored in encrypted configuration, never in source code, and are rotated if we suspect exposure.
- Automated dependency monitoring alerts us to known vulnerabilities in third-party packages so we can patch quickly.
5. Backups and availability
Databases are backed up automatically and continuously, and backups are encrypted and stored separately from the primary database. This lets us restore data in the event of hardware failure, corruption, or human error. We monitor uptime and error rates around the clock and are alerted when something looks wrong.
6. Application security
- Inputs are validated on the server, and database access goes through a typed query layer that uses parameterised queries to prevent SQL injection.
- Output is escaped by default to prevent cross-site scripting (XSS), and form submissions are protected against cross-site request forgery (CSRF).
- Public forms, portals, and widgets include spam and abuse protection.
- Uploaded files are stored on private object storage and served through access-controlled links rather than directly from our servers.
- Code changes are reviewed and run through automated checks before reaching production.
7. Payments
We do not store card numbers. Payments are handled by Stripe, a PCI DSS Level 1 certified provider. Card details go directly from your browser to Stripe and never touch CrowdStack servers.
8. Privacy and data handling
We collect only what we need to run the Service, we do not sell personal data, and we process Customer Data on your instructions as described in our privacy policy. You can export or delete your data in-product, and we delete or anonymise personal data after account closure.
9. Your part
Security is shared. A few things that make a real difference:
- use a long, unique password and a password manager;
- invite only the people who need access, and remove leavers;
- give teammates the lowest role that lets them do their job;
- keep API keys and embed tokens out of public repositories.
10. Responsible disclosure
If you believe you have found a security vulnerability in CrowdStack, please tell us before telling anyone else. Email support@crowdstack.org with the details and steps to reproduce. We will acknowledge your report promptly, keep you updated while we investigate, and will not take legal action against researchers who act in good faith and give us reasonable time to fix the issue.
11. Questions
If you need more detail for a vendor review or have any other security question, email support@crowdstack.org and we will be happy to help.
