Security & data protection

Accounts & authentication

How you get in, and how your credentials are stored.

• Passwords are hashed with argon2id. Sign-in is an email address plus a password. We never store a password itself — what we keep is an argon2id hash of it.
• Session tokens are stored hashed, and sessions can be revoked. Signing in issues a random session token; only a hash of that token is kept in our database. Signing out deletes the session on the server, so the token stops working immediately. Sessions expire on their own as well.
• Company roles are administrator, reviewer and member. The first person to sign a company up is created as that company's administrator. Roles decide who can do what inside your company, and the database stores only those three.

Access control

What your role and your plan allow — decided by the server.

• Administrator-only areas are refused by the server. The administration area — audit log, company profile, account health — checks your company role on the server before it returns anything. Someone who is not an administrator is refused even if they type the address in directly; it is not just a hidden link.
• Plan features are decided on the server, from one table. Which features a plan includes — the OSHA reference library, the admin dashboard, the draft editor — comes from a single plan table that the server consults when it decides whether to allow an action. A screen and a refusal cannot disagree about what your plan covers.

Document review & publishing

The rule the database itself enforces.

• Nothing publishes without a named reviewer. A document can only reach the published state when our database has both a reviewer and a review time recorded against it. The database rejects any published row without them, so no code path — not a bug, not a batch job, not a future AI feature — can publish a document that nobody reviewed.
• Every version is kept, and attributed. Each edit is saved as its own revision, recorded against the person who made it, so the history of what changed — and who approved it — stays with the document.

Subscription access

What happens when a subscription changes state.

• Subscription state is enforced server-side, not in the interface. An active or trialing account has full access. An account with no subscription yet — a signup that has not been through checkout and confirmation — is read-only and is asked to choose a plan; its 14-day free trial is the way in, and there is no other one. A canceled account keeps full access through the period already paid for; after that it becomes read-only — you can still view and export your documentation, and every write is refused by the server with a plain message saying why. An account whose payment has failed is read-only in the same way until payment is sorted out.

Audit log

What is recorded, and exactly how far that goes.

• What it records. Sign-ups, sign-in attempts (including failed ones) and sign-outs, document actions (created, submitted for review, published), changes to records (training, incidents, equipment, employees), and subscription events. Each entry records who acted, what was affected and when.
• What it is, exactly. It is an application activity record kept for your own company. It is not a cryptographically tamper-proof ledger. Companies on the Professional and Multi-Site plans can read their own audit log in the admin dashboard.

Data isolation

Your company's documentation is your company's.

• Everything is stored against your company and queried the same way. Documents and records belong to a company, and every query runs scoped to the company of the person signed in. Cross-company isolation is covered explicitly in our document and records test suites.
• There is no shared pool. Another customer's account cannot read or change your safety documentation. There is no cross-company view, for us or for them, in the customer-facing product.

Email safeguards

Nothing quietly emails anyone.

• Test, sample and demo addresses are refused. No email leaves Crossroads Safety to an address on .example, .test or .invalid, to example.com, or to the demo company's own domain. Every refusal is logged and recorded as not sent.
• Email sending is not connected yet, and the app says so. Until a sending provider is connected, Crossroads Safety records plainly that nothing has been sent rather than implying delivery. The guard above sits in front of it for when sending is switched on.

Hosting

Where it runs, and what we will and won't claim about it.

• HTTPS in transit. The app is served over HTTPS, so traffic between your browser and us is encrypted in transit. It runs on managed hosting, and the database is a managed cloud Postgres (Tiger Cloud).

Payments

Card details never touch our servers.

• Stripe handles the card. Subscriptions are paid through Stripe. Checkout happens on Stripe's own hosted pages and the card details are entered on Stripe's infrastructure. Crossroads Safety does not store card numbers.

Support & contact

A real inbox, read by the team.

• Ask us directly. For security, privacy or data questions — including a vendor-security questionnaire you need filled in — email us. It reaches the Crossroads Safety team.

Email us