Information Security — Public Summary

1. Encryption

• In transit: TLS 1.2/1.3 (AES-256-GCM cipher suites) on every external endpoint. HTTPS-only; HTTP traffic is redirected. Certificates issued by Let's Encrypt and rotated automatically.
• At rest (application layer): high-PII fields (airline credentials, Plaid access tokens, card last4 + nicknames, investment account nicknames) are encrypted via AES-256-GCM with keys held in a restricted environment file outside the application working tree.
• At rest (database volume): sensitive fields are protected by the application-layer AES-256-GCM encryption above regardless of disk state; full-disk (volume-level) encryption is planned ahead of broader rollout.
• Key management: the AES-256-GCM master key is held in /etc/crewbrief/secrets.env with mode 0600 owned by root, injected by systemd. Keys are not present in source control, repositories, or logs.

2. Authentication and access

• End users: passwordless via WebAuthn passkeys; one passkey per device. Phone-number OTP is required for first signup and for recovery.
• Administrative access: SSH-key-only; password authentication disabled; 2FA on the host provider.
• Database access: dedicated crewbrief role with least-privilege grants. The application never connects as a superuser.
• Session security: session cookies are HttpOnly, Secure, and SameSite=Lax (required for PWA home-screen launches). Token rotation on every authentication event.

3. Data minimization

• We collect only the data needed to provide the Service.
• We do not sell data, share with advertisers, or use it for credit / employment / lending decisions.
• Third-party data flows (Plaid, Apple Health, airline systems, Telegram) are scoped to read-only or category-specific permissions you explicitly grant.

4. Logging and monitoring

• Access logs are kept for 90 days for debugging and incident response.
• Application errors are logged at WARNING/ERROR levels and forwarded to an alerting channel.
• No bank account numbers, card PANs, full credentials, or unhashed passkey secrets are logged. Sensitive fields are redacted at log emission.

5. Incident response

• We commit to notifying affected users within 72 hours of confirming a personal data breach, in line with GDPR Article 33.
• Notifications include the nature of the incident, the data categories affected, mitigations taken, and recommended user actions.
• We maintain an internal incident log used to drive root-cause analysis.

6. Vulnerability disclosure

If you believe you have found a security vulnerability, email security@crewbrief.co with details and reproduction steps. We will:

• Acknowledge receipt within 72 hours.
• Provide a triage update within 7 days.
• Credit you in release notes if you wish.

Please do not run scanners or load tests against the production system without prior written permission.

7. Third-party processors

Material data processors used by CrewBrief include (subject to change):

• Stripe — payment processing (PCI-DSS Level 1).
• Plaid — bank account aggregation (SOC 2 Type II).
• LLM providers — for the AI chat features. Conversation snapshots are sent with strict no-training settings; raw user content is not retained by the provider for training.
• SMS / OTP providers — phone-number verification.
• Hosting provider — for infrastructure.

The current list of subprocessors is documented internally and can be provided to qualifying partners (e.g., bank/vendor risk reviews) on request.

8. Full Information Security Policy

9. Contact

security@crewbrief.co