Security, stated plainly.

The model

Every company gets its own API key; only a SHA-256 hash of the key is stored. Every record route requires the key of the company in the URL — one company's key cannot read another company's records, and unauthenticated reads return 401. Company registration is gated by an operator admin key. All inputs are validated (dates, classifications, non-negative day counts, attendee IDs must belong to the company) and plan caps are enforced server-side.

Honest limits

CrewProof v1 runs as a single-node service with a per-company file store. That means: no multi-region redundancy yet, and the operator's deployment is responsible for TLS (via reverse proxy) and daily backups of the data directory. We publish these limits rather than imply otherwise; they are the roadmap, in the open.

What we log

The service logs operational events (company registration, incident recording) for reliability and abuse investigation — never the contents of your safety records beyond the IDs needed to operate the service.