Security at Crowflow

1 Overview

Crowflow is a SaaS pipe: we read campaign data from your connected ad platforms (Google, Microsoft, Meta, TikTok, Snapchat, Reddit, Pinterest, Taboola), plus HubSpot and Salesforce CRM records on Pro and Agency, normalise it, and push it into a Google Sheet you own. We don’t share your data with anyone, sell it, or train models on it. We aim to store as little sensitive material as we can.

Crowflow is a product of Crowbit Limited, a company registered in England and Wales (company number 17234377).

2 Encryption

2.1 In transit

All traffic to and from Crowflow uses TLS 1.2 or higher. HSTS is enforced with a two-year max-age. We don’t accept plain-HTTP connections.

2.2 At rest

Our managed Postgres provider (Neon) encrypts the underlying volumes with AES-256. On top of that, sensitive fields are encrypted at the application layer before they touch the database:

• In place
  OAuth tokens (every connected platform) are encrypted with AES-256-GCM using a workspace-isolated key derived from an environment-held master key. Even a direct read of the database doesn’t yield a usable token.
• In place
  OAuth state cookies used during the consent handshake are encrypted with the same key.

The master key lives only in our hosting provider’s environment variables and is rotated separately per environment (development, production). It never appears in logs, version control, or error reports.

3 OAuth & tokens

Crowflow asks for the narrowest scope each platform permits for our use case:

OAuth handshakes use PKCE (S256 code challenge) end to end. The OAuth state token is bound to a short-lived signed cookie so an attacker can’t replay a stolen authorization code.

You can revoke Crowflow’s access at any time from each platform’s account settings. The next sync will fail and flip the connection to Reconnect needed in your dashboard.

4 Data isolation

Every database row belongs to a workspace. Every query filters by the workspace derived from the authenticated session. There’s no path through the UI or the API where one customer’s data is returned to another. Multi-tenancy is enforced at the query layer.

5 Access controls

User authentication is delegated to Clerk (SOC 2 Type II, ISO 27001, GDPR-compliant). Crowflow never stores passwords. Sessions are short-lived JWTs with rotating refresh tokens.

Production database and infrastructure access is restricted to Crowbit Limited’s founder, with MFA enforced on every provider account. We follow least-privilege for any future hires: read-only by default, time-bound write access when needed.

6 Infrastructure

Crowflow runs on serverless infrastructure with no servers we patch ourselves:

We deliberately do not run our own database, our own auth server, or our own payment processing. Each vendor above is independently audited and we benefit from their security investment.

7 Sub-processors

The full list of sub-processors with purpose and region appears in our Privacy Policy § 7. We maintain it there as a living document and update it before adding a new sub-processor.

8 Incident response

Our incident-response plan covers detection, triage, containment, notification, and post-incident review. If a personal-data breach occurs, we notify the ICO within 72 hours of becoming aware where required (UK GDPR Article 33), and inform affected customers without undue delay where the breach is likely to result in a high risk to them (Article 34).

Sentry alerts on error spikes, including authentication and sync failures, and we monitor connector health continuously.

9 Vulnerability disclosure

If you’ve found a security issue in Crowflow, please email security@crowflow.io rather than disclosing publicly. Include:

• A description of the issue and its impact
• Steps to reproduce
• Any relevant logs, requests, or proof-of-concept

We’ll acknowledge receipt within two business days and aim to remediate confirmed issues within 30 days for critical / 90 days for lower severity. We don’t currently run a paid bug bounty but will credit responsible disclosure on this page with your permission.

Out of scope: denial-of-service attacks, spam, social-engineering attempts against Crowbit Limited employees, and issues in third-party services we use (please report those directly to the relevant vendor).

10 Roadmap

• Planned
  SOC 2 Type I: scoped to begin once Crowflow reaches paid revenue. Target: 2027.
• Planned
  Data Processing Addendum: a downloadable, customer-named DPA will replace the manual-request process before public launch.
• Planned
  Subprocessor change notifications: an email sign-up will let customers receive 30 days’ notice of any addition or change to the sub-processors listed in our Privacy Policy § 7.
• Under consideration
  Bring-your-own encryption key: under consideration for enterprise plans. No firm timeline.

11 Contact

Crowbit Limited
Flat 33, Hartington Court, London, W4 3TT
Security: security@crowflow.io
Privacy: privacy@crowflow.io
General: hello@crowflow.io