Encryption in transit
Every application we deploy is served over HTTPS, with HTTP redirected to HTTPS. Our APIs send HSTS and related security headers.
Authentication
- Short-lived access tokens with refresh tokens, delivered in HttpOnly cookies that page scripts cannot read
- Passwords hashed with bcrypt — never stored or logged in plain text
- Rate limiting on login and other sensitive endpoints
- Time-limited password reset tokens
Authorisation
Permissions are enforced on the server for every API route and every real-time event — hiding a button in the interface is never the check. Staff can only grant permissions they already hold, so role management can’t be used to escalate privileges. Data is scoped to the customer or location it belongs to on every query.
Devices and agents
- Each connected device authenticates with its own secret, and is verified against the account it claims
- Devices receive identifiers, not instructions to run arbitrary programs — they resolve actions against a local allowlist
- Stored third-party credentials are encrypted, and only an ID crosses the wire from the dashboard
- Offline passphrases are stored as scrypt hashes and verified locally
Payments
Card payments are handled by the payment gateway, so card details never touch our servers. Payment webhooks are signature-verified and idempotent, so a forged or repeated notification can’t change an account.
Uploads and input
Uploaded files are checked by their actual content rather than the type the browser claims, and images are restricted to image types before they are ever shown to another user.
Secrets management
Secrets live in environment configuration on the server, not in source code, and are never shipped to the browser.
Audit logging
Significant actions are written to an audit log recording who did what and when, filterable by user, action and resource — so “what happened?” always has an answer.
Updates and dependencies
We keep runtimes and dependencies current, including desktop runtimes that carry browser security fixes, and test upgrades on real hardware before rolling them out.
Reporting a vulnerability
If you believe you have found a security issue in any of our software, email contact@crdevs.com with the details. Please give us a reasonable chance to fix it before disclosing it publicly.
Account and data deletion
To ask for your data to be deleted from this website or from a product account, email contact@crdevs.com. See our privacy policy for what this website collects.