CrowdSmart Security
Security Program Highlights
Data Security
CrowdSmart has successfully completed the System and Organization Controls (SOC) 2 Type II examination in recognition of its commitment to information security. Developed by the American Institute of CPAs (AICPA), SOC 2 (System and Organization Controls) defines criteria for managing customer data based on five “trust service principles” — security, availability, processing integrity, confidentiality, and privacy.
Data Security
CrowdSmart encrypts data at rest and in transit for all of our customers. We use tools like Amazon Web Service’s Key Management System (KMS) to manage encryption keys and Secrets Manager (SM) to manage application credentials and authentication tokens.
Application Security
CrowdSmart employs world class services for system vulnerability scanning and penetration testing. CrowdSmart also uses high-quality static analysis tooling provided by GitHub Advanced Security and others such as dependabot, rackattack, npm and rails audit to secure our product at every step of the development process. Our software engineering team is trained on an ongoing basis in secure coding practices to progressively upskill their secure coding skills.
Infrastructure Security
CrowdSmart uses Amazon Web Services to host our applications. We make extensive use of the security products embedded within the AWS ecosystem. In addition, our backend cloud infrastructure is protected in real time by TrendMicro CloudOne security services to featuring malware attack and unauthorized access prevention, activity and integrity monitoring and live log inspection
In addition, we deploy our application using containers run on AWS managed services, meaning we typically do not manage servers or EC2 instances in production.
CrowdSmart Responsible Disclosure Policy
Data security is a top priority for CrowdSmart, and CrowdSmart believes that working with skilled security researchers can identify weaknesses in any technology. If you believe you’ve found a security vulnerability in CrowdSmart’s service, please notify us; we will work with you to resolve the issue promptly.
This policy applies to the CrowdSmart Application hosted at app.crowdsmart.ai and to any other subdomains or services associated with the CrowdSmart App. We do not accept reports for vulnerabilities solely affecting our marketing website (www.crowdsmart.ai) which contains no sensitive data.
Disclosure Policy
- If you believe you’ve discovered a potential vulnerability, please let us know by emailing us at security@crowdsmart.ai. We will acknowledge your email within one week.
- Please provide us with a reasonable amount of time to resolve the issue before disclosing it to the public or a third party. We aim to resolve critical issues within ten business days of disclosure.
- Make a good faith effort to avoid violating privacy, destroying data, or interrupting or degrading the CrowdSmart service. Please only interact with accounts you own or for which you have explicit permission from the account holder.
Exclusions
While researching, we’d like you to refrain from:
- Denial-of-Service (DoS)
- Spamming
- Social engineering or phishing of CrowdSmart employees or contractors
- Any attacks against CrowdSmart’s physical property or data centers
