Security & Responsible Disclosure

1. How we protect your data

All traffic uses HTTPS (TLS) with HSTS, and data is encrypted at rest by our database and hosting providers. Pages can't be embedded in other sites, which protects against clickjacking.

The database enforces row-level security, so every account can read and change only its own records. Secret keys live only on our servers, never in the browser.

Uploaded invoice PDFs are sent to our AI provider for extraction and then discarded; we keep only the extracted results. API keys are stored as one-way hashes, and webhooks to your systems are signed so you can verify they came from us.

We use established providers: Supabase (database and sign-in), Cloudflare (website and network), Render (application server), Google (Gemini AI, under paid API terms that don't allow training on your data), Dodo Payments and Resend. The full list is on our Sub-processors page.

Your data is never sold, never shared for advertising and never used to train AI models. It is deleted within 30 days of closing your account.

2. Security reviews, DPA and SOC 2

Crerio is not SOC 2 certified yet. We will say so here only once an independent auditor has issued a report.

Until then, we answer your security questionnaire and sign a Data Processing Agreement (DPA) or NDA on request. Email support@crerio.com with "Security review" in the subject.

3. Reporting a vulnerability

Email support@crerio.com with "Security" in the subject. Include the steps to reproduce, the affected page or endpoint, and the impact you expect. Please don't include other people's personal data.

We'll acknowledge your report within 3 business days, keep you updated, and tell you when it's fixed.

4. Testing guidelines

Test only against your own account and data. Don't access, change or delete other customers' data, and stop as soon as you reach data that isn't yours.

Don't run denial-of-service tests, spam, social engineering, or physical attacks, and don't use automated scanners that send large volumes of traffic.

Give us reasonable time to fix an issue before you disclose it publicly.

5. Safe harbour

If you follow these guidelines in good faith, we won't take legal action against you for your research, and we'll work with you to understand and fix the issue. We don't currently run a paid bug bounty.