Security
What we do to protect operational records, evidence photos and team accounts — described specifically enough that you can hold us to it.
Accounts and access
- Passwords hashed with Argon2id (64 MB memory cost), never stored or logged in plain text.
- Staff PINs are hashed the same way and are scoped to a single location, with per-device rate limiting on top.
- Sign-in attempts are throttled per email and per network; repeated failures lock the account temporarily.
- Sessions are rotated periodically, bound to the browser, and expire on idle as well as absolutely.
- Roles are checked on every request against the database, not against the session — a demoted user loses access immediately.
Tenant isolation
Every record carries an organisation id, and every query filters on it. Location access is checked separately: a manager at one site cannot read another site's records even within the same workspace. There is no "view as any org" path in the customer application.
Evidence integrity
- Photos are re-encoded server-side on upload, which strips EXIF metadata including GPS.
- The file type is determined from the image contents, never from the filename or the browser's declared type.
- A SHA-256 hash of every stored photo is recorded, so tampering with the file on disk is detectable.
- Uploads are stored outside every web root and served through a permission-checked route.
- Completed records are append-only: they can be voided with a reason, never silently edited.
Application hardening
- Every database query is a prepared statement. No user input is concatenated into SQL.
- All output is escaped at the point of rendering; SOP content is passed through a strict HTML allowlist.
- CSRF tokens on every state-changing request, verified in constant time.
- A restrictive Content-Security-Policy with no inline scripts, plus HSTS, nosniff and frame-ancestors none.
- Cookies are HttpOnly, SameSite=Lax and Secure, with separate names per surface.
Support access
When we need to look at your workspace to resolve a ticket, we use a time-boxed support session that is strictly read-only and requires a written reason. Every support session is recorded in your own activity log, so you can see exactly when we looked and why. We cannot sign a check off on your behalf.
Infrastructure
The platform runs on a hardened Ubuntu host with TLS terminated at the edge, HTTP redirected to HTTPS, and the super-admin console optionally restricted to an IP allowlist. Database credentials live in a file readable only by the web user and are deliberately kept out of the environment superglobals, so a stray phpinfo() cannot leak them.
Reporting a vulnerability
Email security@crewbyte.io with enough detail to reproduce the issue. We will acknowledge within two working days. Please don't run automated scanners against production or access data that isn't yours — tell us and we'll set up an environment where you can dig properly.