Security at Crux

Crux is committed to keeping your data secure.

Data Protection

Crux protects data both in transit and at rest.

Data in Transit – TLS v1.2+ encryption
Data at Rest – AES 256 encryption

Secret Management – User account passwords are encrypted at the application level before being stored in the database. Application secrets are encrypted at rest and access is strictly limited.

‍

Secure Development

Secure development best practices have been integrated into the Crux software development lifecycle.

Code repository controls
Deployment controls
Peer code review
Penetration testing
Security training for engineers
Separation of development, staging, demo, and production environments
Threat modeling
Vulnerability scanning

‍

Infrastructure Security

Crux is hosted by Supabase and Vercel, which host their services on Amazon Web Services, Azure, and Google Cloud Platform. Supabase and Vercel share our commitment to security and have achieved compliance with numerous frameworks including SOC 2 Type 2.

‍

Company Policies and Procedures

Crux’s security, risk, and compliance processes were developed based on industry best practices and are reviewed and updated on an annual basis or upon any significant organizational change.

Security Policies and Training – All employees go through required training upon hire that is renewed annually. Policies include:

Access Control
Asset Management
Code of Conduct
Cryptography
Data Management
Human Resources Security
Information Security
Operations Security
Risk Management
Secure Development
Third-Party Management

Platform Security – Ongoing security activities include:

Application log alerting, analysis, and retention
Penetration testing
Vulnerability scanning

Incident Response Planning & Team in place to handle any significant security event to triage and respond to establish system resiliency, minimize impact, and protect customer data.
Regular Third-Party Security Review that identifies and evaluates security risks of vendors and third parties.

‍

Standards and Certifications

Crux is committed to establishing and maintaining compliance with key information security and regulatory standards starting with Service Organization Control (SOC) 2. We are scheduled to complete a 6-month SOC 2 audit observation period in May 2024 with an industry-leading auditor with specific expertise in fintech.

Upon completion, Crux’s SOC 2 Type 2 report will be available for limited distribution and shared under non-disclosure agreements.

‍

Helpful Links

Supabase Security – https://supabase.com/security
Vercel Security – https://vercel.com/security