Security and data handling

Where the data lives

• The website and the platform (app.crossnorm.com) run on Cloudflare Workers. There are no servers of our own to patch or expose.
• The regulatory data (values, quotes, acts, decisions, registers) and the archive of the official pages and documents we read are kept in Cloudflare R2 storage in the EU jurisdiction. The archive keeps its copies for 365 days; the copies without personal data are under an object lock and cannot be changed or deleted in that time.
• Customer accounts are in a managed MySQL 8.4 database (Aiven) in Frankfurt. The platform reaches it only over TLS with the server's certificate verified, through separate database users for reading, writing and schema changes.

What we hold about customers

• the organisation's name and segment, and its plan: the markets, the dates and the basis of each grant;
• the work e-mail address and role of each user;
• API keys as SHA-256 hashes only: a key is shown once, when it is made, and cannot be read back;
• sign-in events with keyed hashes of the IP address, not the address itself;
• the number of API calls per day, for the plan's quota.

We hold no payment card data.

Access

• Customers sign in with a one-time link sent to their work address: it works for 15 minutes and once. Sessions are signed cookies; signing out everywhere ends every session of the user.
• Each organisation's owner invites its users and makes its API keys. A revoked key stops within a minute; a rotated key keeps working for a short grace period so that integrations can switch.
• Sign-in and the API are rate-limited; the API has a monthly quota per plan.
• Our staff sign in separately from customers, with rate limits on every attempt.

Audit trail and history

Every change to an organisation, its users, invitations, grants and API keys is one database transaction with its audit record: who, what, when. The history of the regulatory data is append-only: a new value is a new version linked to the previous one by a hash, and nothing is overwritten.

Encryption and copies

• All traffic is HTTPS (TLS); the database connection is TLS with certificate verification.
• Data at rest is encrypted by the providers (Cloudflare R2, Aiven).
• The customer accounts database is backed up daily by its provider (Aiven), which keeps the last two daily backups. We make no other copies of it, and it cannot be restored to a point in time.
• The regulatory data and the source archive are in R2 as described above.

Providers

The data we publish

Every value has its official source, the words of the source in the original language and the dates it was retrieved and checked. Names of people appear only as an official register or list publishes them, with that source and date; we build no pages or searches about people. Details: privacy notice.

Questionnaires and reports

We answer security and procurement questionnaires on request, and we answer every security report. Write to hello@crossnorm.com.