Certifications & posture
Independently audited, honestly reported
Crush Security is ISO 27001:2022 certified and runs a SOC 2-aligned program, with SOC 2 Type II in progress. We update this page as milestones are reached.
ISO 27001:2022 certified
Information security management system, independently audited.
SOC 2 Type II in progress
Trust services examination underway. We report progress, not promises.
Veteran owned & operated
Built and led by military veterans.
Security controls
How your data is protected
Tenant isolation
Each customer separated at the database level, independently provisioned and scoped. Isolation is infrastructure, not a row filter.
Identity & access
SSO, MFA, and least-privilege RBAC, tenant-scoped. Staff access is assigned per engagement, never globally.
Encryption
AES-256 at rest and TLS 1.3 in transit, end to end.
Audit logging
Tamper-evident logging of all access and changes, traceable end to end.
Monitoring & response
24/7 monitoring, real-time anomaly alerting, and a tested incident response plan.
Secure development
SDLC with code review, static analysis, dependency scanning, and quarterly penetration testing.
Managed infrastructure
Hardened cloud infrastructure as code, passwordless service identities, centrally managed secrets, automated patching.
AI governance
AI-assisted analysis runs under enterprise governance controls. Client data is not used to train external models outside contractual and regulatory controls.
Data handling & privacy
Your data, your control
Data residency
Choose where your data is stored with regional deployment options.
Data portability
Export your data at any time in standard formats.
Data deletion
Complete data removal within 30 days of account closure.
Data minimization
We collect and retain only what is necessary to deliver the service.