Last updated: June 1, 2026
Security is part of how we deliver — not an afterthought bolted on at launch. This policy summarizes our baseline posture for website operations and client engagements.
Client systems are accessed only by assigned personnel. We prefer MFA-protected tooling, unique credentials, and timely revocation when engagements end or roles change.
We encourage dependency awareness, secrets kept out of source control, environment separation (dev / staging / production), and code review for material changes. Specific controls are agreed per project.
Where we manage cloud or hosting, we apply patching cadence, backups with restore awareness, encryption in transit (TLS), and monitoring appropriate to the workload. Client-owned accounts remain under client governance unless otherwise contracted.
We treat client data as confidential. Production data is not copied to personal devices casually. Sharing occurs through agreed channels. Retention follows contract and legal needs.
Suspected security incidents affecting client systems are escalated promptly to the named client contact. We document facts, contain impact, and cooperate on remediation. Public disclosure follows legal and contractual requirements.
We evaluate critical subprocessors for baseline security practices. Ultimate responsibility boundaries are defined in statements of work.
Clients remain responsible for their user access reviews, business continuity decisions, and timely communication of security requirements unique to their industry.
If you believe you have found a vulnerability on a CrewCrafted-operated property, contact hello@crewcrafted.com with details. Please avoid public disclosure until we can investigate.
See also our Privacy Policy and Terms of Use.