How CrewForge protects your customers' data
Your customers trust you with their home addresses, phone numbers and payment details. Here's exactly how we protect them.
Your customer data is your responsibility
When you manage jobs in a field service app, you are trusting that software with personally identifiable information (PII)—your customers' full names, home and business addresses, phone numbers and email addresses.
If a software tool you chose mishandles that data, your customers will look to your company for answers, not to a software vendor they've never heard of.
Before you trust any web application with your customers' personal information, demand to know exactly how they protect it. If they can't answer clearly, that is your answer.
What You Should Demand From Any FSM Software
These are not premium features. These are baseline requirements for handling your customers' data responsibly.
Encrypted Passwords
Passwords must be cryptographically hashed—never stored in readable form. If a database is compromised, properly hashed passwords are designed to be irreversible.
Encrypted API Tokens & Credentials
Any third-party tokens (QuickBooks, payment processors, etc.) stored in their database must be encrypted at rest using strong, authenticated encryption.
HTTPS Everywhere (TLS/SSL)
Every page, every API call, every data transfer must be encrypted in transit. No exceptions. If any part of the app loads over plain HTTP, walk away.
Security Headers
HTTP security headers (HSTS, Content-Type protection, XSS filters, referrer policies) prevent common web attacks. Ask if they enforce them on every response.
Strong Password Requirements
Weak passwords are one of the most common ways accounts get taken over. The software should enforce a minimum length and reject well-known passwords.
Role-Based Access Control
Not every user needs access to everything. Technicians, admins, and owners should each see only what they need—enforced at the server level, not just the UI.
Tenant Data Isolation
Your data must be completely walled off from other companies using the same software. Every database query should be scoped to your organization only.
Rate Limiting & Brute-Force Protection
Login pages and APIs must be protected against automated attacks. Without rate limiting, attackers can guess passwords thousands of times per minute.
Server-Side Authorization
Access control must be enforced on the server, not just hidden in the interface. Every API route must verify who is making the request and whether they are allowed.
Bot Protection on Public Forms
Any public-facing form (signup, contact, demo requests) should be protected by CAPTCHA or equivalent to prevent automated abuse and spam.
How CrewForge handles each of these
Here is what we do, in plain language.
Industry-Standard Password Hashing
Every user password is processed through a one-way cryptographic hashing algorithm with an adaptive cost factor before it is stored. Hashed passwords are designed to be irreversible—they cannot be decrypted or read back in plain text, even by our team.
Authenticated Encryption for Stored Credentials
Third-party API tokens (such as QuickBooks OAuth credentials) are encrypted at rest using authenticated encryption. This means stored credentials are protected against both unauthorized reading and tampering.
TLS/HTTPS on Every Connection
All traffic between your browser and our servers is encrypted using TLS (Transport Layer Security). We enforce HSTS so browsers are instructed to always connect securely—plain HTTP connections are not permitted.
Security Headers
Our server responses include security headers (HSTS, content-type protection, referrer policy and device permission limits) that help protect against common web attacks.
Password Rules
Passwords must be at least 8 characters, and well-known passwords are rejected at signup. Passwords that don't meet the rules are never stored.
Server-Enforced Role-Based Access
Users are assigned roles with distinct permissions, and those permissions are checked on our servers, not just hidden in the interface. Technicians don't get access to admin reports, billing or team management.
Tenant Data Isolation
Account data is scoped to your organization. The system is designed so that one company's users can't see another company's customers, jobs or financial data.
Rate Limiting
Sign-in, signup, data exports, payment and other sensitive endpoints have request-rate limits, so repeated automated attempts get slowed down and blocked.
Signed-In Access to Your Data
Requests for your account data check who is signed in, their role and their company before anything is returned. Links you send customers (such as payment or approval links) use hard-to-guess tokens and show only what that customer needs.
Bot Protection
Our demo request form uses Google reCAPTCHA, and public forms are rate limited to cut down on automated abuse and spam.
Hold Every Vendor to This Standard
We built this page not just to show you what CrewForge does—but to give you a checklist to hold every software vendor accountable. Your customers trust you with their personal information. That trust is not something to gamble with a tool that can't explain how it protects their data.
30 days free · No credit card · Cancel anytime
Questions from your IT person or insurer? Email [email protected] or call Call us.