Security at Crowflow

1Overview

Crowflow is a SaaS pipe: we read campaign data from your connected ad platforms (Google, Microsoft, Meta, TikTok, Snapchat, Reddit, Pinterest, Taboola) — plus HubSpot and Salesforce CRM records on Pro — normalise it, and push it into a Google Sheet you own. We don’t share your data with anyone, sell it, or train models on it. The smallest amount of sensitive material we can store is what we aim for.

Crowflow is a product of Crowbit Limited, a company registered in England and Wales (company number 17234377).

2Encryption

2.1 In transit

All traffic to and from Crowflow uses TLS 1.2 or higher. HSTS is enforced with a two-year max-age. We don’t accept plain-HTTP connections.

2.2 At rest

Our managed Postgres provider (Neon) encrypts the underlying volumes with AES-256. On top of that, sensitive fields are encrypted at the application layer before they touch the database:

• OAuth tokens(every connected platform) are encrypted with AES-256-GCM using a workspace-isolated key derived from an environment-held master key. Even a direct read of the database doesn’t yield a usable token.
• OAuth state cookies used during the consent handshake are encrypted with the same key.

The master key lives only in our hosting provider’s environment variables and is rotated separately per environment (development, production). It never appears in logs, version control, or error reports.

3OAuth & tokens

Crowflow asks for the narrowest scope each platform permits for our use case:

• Google Ads: adwords (read campaign data only — we never make write calls)
• Google Sheets: drive.file (deliberately non-sensitive — we can only access Sheets you create with Crowflow or pick via the Google Picker)
• Microsoft Advertising: msads.manage (the single scope Microsoft offers; we use only the read surface)
• Meta Ads: ads_read
• TikTok, Snapchat, Reddit, Pinterest, HubSpot, Salesforce: the narrowest read scope each platform offers for campaign or record data; Taboola uses scoped API credentials you paste in.

OAuth handshakes use PKCE (S256 code challenge)end to end. The OAuth state token is bound to a short-lived signed cookie so an attacker can’t replay a stolen authorization code.

You can revoke Crowflow’s access at any time from each platform’s account settings. The next sync will fail and flip the connection to Reconnect needed in your dashboard.

4Data isolation

Every database row belongs to a workspace. Every query filters by the workspace derived from the authenticated session — there’s no path through the UI or the API where one customer’s data is returned to another. Multi-tenancy is enforced at the query layer, not by trust.

5Access controls

User authentication is delegated to Clerk (SOC 2 Type II, ISO 27001, GDPR-compliant). Crowflow never stores passwords. Sessions are short-lived JWTs with rotating refresh tokens.

Production database and infrastructure access is restricted to Crowbit Limited’s founder, with MFA enforced on every provider account. We follow least-privilege for any future hires: read-only by default, time-bound write access when needed.

6Infrastructure

Crowflow runs on serverless infrastructure with no servers we patch ourselves:

• Application: Vercel (Frankfurt-region edge + functions; SOC 2 Type II, ISO 27001)
• Database: Neon Postgres (eu-central-1; SOC 2 Type II)
• Auth: Clerk (SOC 2 Type II)
• Billing: Stripe (PCI-DSS Level 1)
• Transactional email: Resend (SOC 2 Type II)
• Error tracking: Sentry (SOC 2 Type II)

We deliberately do not run our own database, our own auth server, or our own payment processing. Each vendor above is independently audited and we benefit from their security investment.

7Sub-processors

The full list of sub-processors with purpose and region appears in our Privacy Policy § 6. We maintain it as a living document; the canonical version will move to crowflow.io/sub-processors before public launch.

8Incident response

Our incident-response plan covers detection, triage, containment, notification, and post-incident review. If a personal-data breach occurs, we notify the ICO within 72 hours of becoming aware where required (UK GDPR Article 33), and inform affected customers without undue delay where the breach is likely to result in a high risk to them (Article 34).

Sentry alerts on error spikes, including authentication and sync failures, and we monitor connector health continuously.

9Vulnerability disclosure

If you’ve found a security issue in Crowflow, please email security@crowflow.io rather than disclosing publicly. Include:

• A description of the issue and its impact
• Steps to reproduce
• Any relevant logs, requests, or proof-of-concept

We’ll acknowledge receipt within two business days and aim to remediate confirmed issues within 30 days for critical / 90 days for lower severity. We don’t currently run a paid bug bounty but will credit responsible disclosure on this page with your permission.

Out of scope: denial-of-service attacks, spam, social-engineering attempts against Crowbit Limited employees, and issues in third-party services we use (please report those directly to the relevant vendor).

10Roadmap

• SOC 2 Type I: scoped to begin once Crowflow reaches paid revenue. Target: 2027.
• Data Processing Addendum: a downloadable, customer-named DPA will replace the manual-request process before public launch.
• Subprocessor change notifications: an email sign-up at /sub-processorswill let customers receive 30 days’ notice of any sub-processor addition or change.
• Bring-your-own encryption key: under consideration for enterprise plans. No firm timeline.

11Contact

Crowbit Limited
Flat 33, Hartington Court, London, W4 3TT
Security: security@crowflow.io
Privacy: privacy@crowflow.io
General: hello@crowflow.io