We hold ourselves to the standard we sell
A security product earns trust by showing its work. Here's how crowid.com is built, what it stores and how to report a problem.
Small surface, by design
crowid.com runs as a single application on Cloudflare's global edge network, with data in one encrypted, strongly consistent store. There are no servers of ours to patch and no third-party scripts on any page.
What protects your account and data
Credential protection
PBKDF2 with 100,000 iterations and a 16-byte salt per password. Failed sign-ins are rate limited per account and per network address.
Session hygiene
Sessions last 30 days at most. Changing your password signs out every other session; signing out deletes the session server-side.
Request integrity
Every state-changing request must come from crowid.com itself. Cross-site requests are rejected before they reach your data.
Public-data-only scanning
Domain scans read public DNS, HTTPS responses and Certificate Transparency logs. Nothing is installed, and no credentials are requested.
Secrets stay with you
The secret scanner runs in your browser. Text you paste and files from repos you scan are never sent to CrowID.
Data minimisation
We keep only what the product needs, use no analytics or advertising cookies, and delete everything when you delete your account.
| Data | Why | Kept until |
|---|---|---|
| Name, email, company | Your account | You delete your account |
| Password hash and salt | Signing you in | You delete your account |
| Session token hash | Keeping you signed in | Sign-out or 30 days |
| Scan results, monitored domains, alerts | The product | You delete them or your account |
| Demo and contact requests | Replying to you | No longer needed |
| Network address | Rate limiting | Short-lived counters only |
Found a vulnerability? Tell us.
We welcome reports from security researchers and will work with you to understand and fix any issue in crowid.com.
How to report
Send details through our contact form with "Security" in the message: what you found, the steps to reproduce it and the impact you believe it has. Our machine-readable policy is at /.well-known/security.txt.
What we ask
- Test only against your own account and data, and stop as soon as you've confirmed an issue.
- Don't access, change or delete other people's data, degrade the service, or run automated scanning at volume.
- Give us reasonable time to fix the issue before disclosing it publicly.
What we commit to
- Acknowledge your report and keep you updated while we investigate.
- Not pursue legal action for good-faith research that follows these guidelines.
- Credit you once the fix ships, if you'd like.