How Crawlux protects your data.
Defense-in-depth security architecture covering encryption, access control, incident response and vulnerability disclosure. Built on AWS with EU-region primary hosting for GDPR alignment.
Security key facts
Five layers of security
Crawlux applies layered defense across infrastructure, network, application, data and operational controls. An attacker would need to compromise multiple independent layers to access user data, with each layer raising the cost of attack.
AWS-hosted with EU primary region
Production runs on AWS eu-west-1 with backup replicas in eu-central-1. Hardware security, physical access control and supply chain integrity inherited from AWS SOC 2 Type II controls.
VPC isolation with WAF and DDoS protection
Production VPCs isolated from public internet except through ALB endpoints. CloudFlare WAF filters known attack patterns. AWS Shield Standard mitigates DDoS at the network edge.
Authentication, rate limiting and CSRF protection
All authenticated routes require valid session tokens. Rate limits applied per IP and per account. CSRF tokens for state-changing operations. Input validation at every API boundary.
AES-256 encryption at rest, TLS 1.3 in transit
Database, object storage and backup storage all encrypted with AES-256 using AWS KMS-managed keys. API traffic protected with TLS 1.3 minimum. API keys and webhook secrets use envelope encryption.
Access logs, audit trails and MFA-required admin
Production database access requires MFA. All access logged with user, action and timestamp. Monthly access audits identify and remove unused permissions. Customer data access requires logged justification.
Encryption coverage
Encryption applies to every data category Crawlux handles. The table below maps each data type to the encryption mechanism and key management approach.
| Data type | In transit | At rest | Key management |
|---|---|---|---|
| Audit JSON output | TLS 1.3 | AES-256 | AWS KMS |
| PDF reports | TLS 1.3 | AES-256 | AWS KMS · S3 SSE-KMS |
| User account data | TLS 1.3 | AES-256 | AWS RDS encryption |
| API keys (when launched) | TLS 1.3 | AES-256 · envelope | Customer-isolated keys |
| Webhook signing secrets | TLS 1.3 | AES-256 · envelope | Customer-isolated keys |
| Payment data | TLS 1.3 to Stripe | Stripe-side only | Stripe PCI infrastructure |
| Database backups | TLS 1.3 | AES-256 | Cross-region replicated |
| Server logs | TLS 1.3 | AES-256 | CloudWatch encryption |
Customer-isolated key encryption
API keys and webhook signing secrets use envelope encryption where each customer's secrets are encrypted with a per-customer KMS key. A breach of one customer's storage layer does not expose other customers' secrets.
Who has access to your data
Access to production systems and customer data is restricted to engineering team members with documented business need. The principle of least privilege applies across every system. All access is logged.
5-phase incident response
When a security incident is detected, the response follows a defined 5-phase process with clear timing targets at each phase. The status page logs all confirmed incidents publicly with timestamps.
Responsible disclosure program
Security researchers who find vulnerabilities can disclose them through our responsible disclosure program. We follow coordinated disclosure principles with response time targets that scale with severity.
| Severity | Initial response | Remediation target |
|---|---|---|
| Critical (RCE, auth bypass, data exposure) | 24 hours | 7 days from confirmation |
| High (privilege escalation, sensitive disclosure) | 3 business days | 30 days from confirmation |
| Medium (information disclosure, lower-impact issues) | 5 business days | 60 days from confirmation |
| Low (minor issues, defense-in-depth) | 10 business days | 90 days from confirmation |
Safe harbor for researchers
Researchers acting in good faith within scope of this program are not subject to legal action under the terms of service. Out of scope: social engineering of staff, physical attacks, denial-of-service testing, attacks against customer accounts.
Certifications and roadmap
Crawlux runs on AWS infrastructure with extensive certifications inherited from the platform. Independent Crawlux certifications are on the roadmap with target dates published openly.
Common questions
Six questions covering encryption, incident response, vulnerability disclosure, internal access, geographic data location and certifications.
Is my audit data encrypted?
Yes. All data is encrypted in transit using TLS 1.3 and at rest using AES-256. Database storage, backup storage and object storage all use AES-256 encryption with keys managed by the cloud provider's KMS. API keys and webhook signing secrets are encrypted with envelope encryption using customer-isolated keys.
How do you handle security incidents?
Security incidents follow a 5-phase response process: Detection within 15 minutes via automated monitoring, Containment within 1 hour to limit blast radius, Assessment within 4 hours to determine scope and impact, Remediation typically within 24 hours and Communication to affected users within 72 hours of confirmation. The status page logs all confirmed incidents with timestamps.
Do you have a vulnerability disclosure program?
Yes. Security researchers can disclose vulnerabilities at [email protected]. We follow responsible disclosure principles with a 90-day coordinated disclosure window. Critical vulnerabilities receive a 24-hour response window. We do not currently offer bug bounties but do publicly credit disclosed researchers in our hall of recognition.
Who has access to my data internally?
Access is limited to engineering team members with documented business need. All access is logged with user, action and timestamp. Production database access requires multi-factor authentication and is audited monthly. Customer data is never accessed for non-essential reasons. Support requests requiring data access are logged with the requester, recipient and justification.
Where is my data stored geographically?
Primary infrastructure is hosted on AWS in EU regions (eu-west-1 and eu-central-1) for GDPR alignment. Backup replicas are in AWS US regions (us-east-1) for redundancy. Audit results may be processed in upstream provider regions during analysis (DataForSEO, AI engines) but processed data returns to our EU primary infrastructure within minutes.
What certifications do you hold?
Crawlux infrastructure runs on AWS which holds SOC 2 Type II, ISO 27001 and ISO 27017. Crawlux as a company is currently working toward independent SOC 2 Type II certification with target completion Q4 2026. The roadmap includes ISO 27001 certification target Q2 2027. Enterprise contracts can request the AWS attestation reports immediately.
Security contact
For vulnerability disclosure, security questions or incident reporting, the dedicated security email gets routed to the engineering security team directly.
Security disclosure
Email: [email protected]
PGP key: Available on request
Response window: Per severity table above
Coordinated disclosure: 90-day window from confirmation
For privacy-related security questions, see the privacy policy. For acceptable use questions, see the acceptable use policy. For service status during incidents, see the status page.
RUN YOUR FIRST AUDIT FREE
See Crawlux on your own crypto site.
No signup, no credit card. Full Web3-tuned audit report in 60 seconds.
Free first audit · No signup · 60 seconds · Full PDF report