Security

How CRUMP360 protects your data.

Infrastructure

• Hosted on Vercel with TLS everywhere and HSTS enforced.
• Data stored in Postgres on Supabase, with row level security enforced on every table so one organization's data is never reachable by another.
• A strict Content Security Policy with per-request nonces, and standard security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy).

Access control

• Role-based access: owner, admin, event manager, instructor, finance, check-in, and learner, each limited to what that role needs.
• Optional two-step verification (authenticator app) for any account.
• Single sign-on (SAML) available on the Campus plan.
• An append-only audit log of security-relevant actions for organization owners and admins.

Payments

Card details never touch our servers. Payments are processed by Stripe, a PCI DSS Level 1 service provider, and ticket revenue for an event goes directly to that organization's own connected Stripe account.

Reporting an issue

If you believe you have found a security vulnerability, email security@crump360.com with details. We will acknowledge reports within two business days and ask that you not publicly disclose an issue until we have had a reasonable chance to address it.