Security

Security is a core part of how we build and operate CrunchJunkie. The measures described below are what the platform does as of the date at the top of this page; they are maintained continuously and reviewed at least annually.

All data in transit is encrypted using TLS 1.2 or higher, with HSTS enforced. AI API keys, OAuth access/refresh tokens, single sign-on client secrets and webhook signing secrets are encrypted with AES-256-GCM at the application layer before storage (a webhook secret created before 10 November 2026 is encrypted on its endpoint's next delivery); the database is additionally encrypted at rest by our infrastructure provider. Passwords are hashed with bcrypt (cost factor 12) and never stored in plain text. API keys are stored only as a SHA-256 hash.

The platform's compute and file storage run on Vercel in the EU (Frankfurt); the database runs on Neon's managed PostgreSQL service, also in the EU (Frankfurt). Every night we take an encrypted backup of the database and keep it for 30 days in a private storage area, also in Frankfurt (the same region as the database). Both providers maintain their own security certifications and DPAs; our sub-processors are listed on the Trust page.

Database access in the platform is scoped to the authenticated user's workspace at the application layer, and automated checks on every change guard the routes that read or write customer data. A read-only seat is enforced on the role the database holds for the workspace the request acts in, not only on the sign-in cookie, so a person with a read-only seat cannot change that workspace's data.

Two-factor authentication (an authenticator app with single-use recovery codes) is available to every user and can be required for a whole workspace. Enterprise single sign-on (OpenID Connect) is available per workspace. Access to our administration area, which can reach customer workspaces, requires a fresh second factor on top of the administrator's sign-in; the proof is valid for 12 hours. Staff "view as" access is read-only, and sensitive staff actions are recorded in an audit trail that is kept for 24 months. Production database and infrastructure access is restricted to a minimal set of authorised personnel.

Account holders can see a log of the security events of their own account, and workspace owners and admins can see the workspace's: sign-ins, failed sign-ins of an existing account, lockouts, and changes to two-factor authentication, passkeys, passwords, members and roles, single sign-on, API keys, connected AI assistants and data exports. Entries keep the network part of the IP address (never the full address) and the browser family, and are deleted after 12 months. Details are in our Privacy Policy.

Authentication endpoints and sensitive API routes are rate-limited per IP to protect against credential stuffing and brute-force attacks. Since September 2026 the counters are held in a shared store in the EU (Frankfurt), so the limit applies across all application instances; counters expire within minutes. Password-protected report share links lock for 15 minutes after 10 wrong attempts. The connection of an advertising or analytics account carries a signed, time-limited state value that is checked against the signed-in user.

We maintain a documented incident-response process. In the event of a personal data breach affecting customer data, we will notify affected customers without undue delay and at the latest within 72 hours of becoming aware of it, as our Data Processing Agreement provides.

If you discover a security vulnerability, please report it responsibly to security@crunchjunkie.io with the subject line "Security Report". We will: • Acknowledge your report within 2 business days. • Keep you informed of our progress. Please do not publicly disclose the issue until we have had a reasonable opportunity to address it. We do not currently operate a bug-bounty programme, but we deeply appreciate responsible disclosures.