Skip to content
Canada Proudly Canadian. Your business data is stored in Canada.
crewduo
Legal

Security Overview

Last updated October 2, 2026 · Doable Link Inc.

Businesses trust crewduo with their clients, schedules and payments. This page summarizes how we protect that data. The contractual commitments are in the Data Processing Addendum.

Infrastructure

  • Hosted on Microsoft Azure in Canada (Canada Central, Toronto).
  • The database runs on a private network with no public endpoint. Only the crewduo application can reach it.
  • Public traffic passes through Cloudflare for TLS, DDoS protection and a web application firewall.
  • Application secrets and keys are kept in Azure Key Vault, not in source code.
  • Automated database backups with point-in-time restore.

Encryption

  • All connections to crewduo use HTTPS (TLS), and connections from the application to the database are encrypted.
  • Databases, file storage and backups are encrypted at rest.

Accounts and access

  • Two-factor authentication with an authenticator app or an emailed code, with one-time recovery codes.
  • Passwords are stored only as salted hashes, and sign-in attempts are rate-limited.
  • Optional "Continue with Google" and "Sign in with Apple".
  • Role- and permission-based access, so each person sees only what their role allows.
  • Every Business's data is isolated from other Businesses at the data-access layer.
  • An activity log records who changed what in each Business.
  • Signing out ends that device's session; deleting an account in the mobile app ends sessions on every device.

Payments

Card payments, card readers and payouts are handled by Stripe, a PCI DSS Level 1 certified service provider. Card numbers go directly to Stripe and are never stored by crewduo.

Mobile app

  • Sign-in tokens are stored in the iOS Keychain or Android Keystore.
  • Optional Face ID or fingerprint lock after the app has been in the background.
  • Offline data stays on the device only until it syncs, and is removed on sign-out.
  • No advertising or third-party tracking SDKs.

Our team and processes

  • Production access is limited to staff who need it, through a separate administration application restricted to approved staff.
  • Service providers are bound by confidentiality and security obligations; see Subprocessors.
  • If we confirm a security incident affecting a Business's data, we notify that Business without undue delay, as described in the Data Processing Addendum.

Reporting a vulnerability

If you believe you have found a security vulnerability in crewduo, email [email protected] with the subject "Security report". Include the steps to reproduce it. Please give us reasonable time to fix the issue before disclosing it. Do not access or modify other people's data, disrupt the Service, or run automated scans that degrade it. We will not take legal action against good-faith research that follows these guidelines.