Last updated: 29 September 2026
Tenant isolation
Every workspace’s data is isolated at the database level using Row Level Security on every table that holds customer data, plus an explicit workspace filter on every query. Any operation that needs to cross workspaces goes through a single, audited path, with the audit record written before the action occurs.
Access controls
Every action a user takes checks their identity, their workspace, and their permission for that specific action. A failed check returns a “not found” response rather than an “access denied” response, so the platform’s internal structure cannot be probed by testing error responses.
Encryption
- In transit: all traffic is encrypted using HTTPS/TLS.
- At rest: stored secrets, access tokens and integration credentials are encrypted using AES-256-GCM.
- Passwords are stored only as secure, salted hashes — never in plain text.
- One-time links (signing links, invoice payment links) are stored only as hashed values, and expire automatically.
Account security
Two-factor authentication is available via any standard authenticator app. Users can view and remotely end their own active sessions. Sign-in attempts are rate-limited to slow brute-force attacks. Password reset is self-service.
Audit trail
A comprehensive, searchable audit log records staff impersonation of an account (for support purposes), module and settings changes, integration key changes, credential vault reveals, signing events, and access and membership changes — searchable by workspace, person, action and date.
Upload security
Every uploaded file is checked for size, and its actual content is verified against its claimed file type (not just its extension). Uploads are protected against path-traversal attacks, and downloads are streamed rather than exposing direct file paths.
Monitoring
Error tracking runs across the web application and background job systems. Independent uptime monitoring checks whether background processes (which handle emails, signing and reminders) are actually running, not just whether the website itself loads.
Data breach response
If we become aware of an eligible data breach, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme, and will notify affected customers without undue delay.
Reporting a vulnerability
If you believe you have found a security vulnerability in Crittiks, report it to support@crittiks.com. We acknowledge every report we receive.
Contact: support@crittiks.com