Crestlio

Security and trust

Crestlio handles highly sensitive employment information. Controls are built into the data model, not layered on afterwards.

This page is maintained by the app owner and describes controls that are actually enabled in this application. It is not an independent audit, certification, or attestation. Read the privacy notice for data handling, retention, and individual rights.

Tenant isolation

  • • Every tenant-owned record carries an organization ID
  • • Row-level security enforced in the database, not only in the interface
  • • Authorization checked at the API and database layers
  • • No tenant can read another tenant's data

Record integrity

  • • Append-only audit events with actor, action, values, reason, and address
  • • Employee responses can never be deleted by managers or HR
  • • Amendments preserve prior versions and require a written reason
  • • Acknowledgment stores the exact wording displayed at the time

Privacy by design

  • • Email notifications carry no names, references, or performance details
  • • Internal-only fields are separated from employee-visible content
  • • Reviewer access is explicitly granted, scoped, and time-limited
  • • Exports and downloads are logged

Governance readiness

  • • Configurable retention and legal holds that block deletion
  • • Architecture prepared for SOC 2 Type II, ISO 27001, GDPR, and CCPA programs
  • • Accessibility targets WCAG 2.2 AA; status is never conveyed by color alone
  • • No certification is claimed until it has actually been completed

Account security

  • • Anonymous sign-in is disabled; every session is tied to a verified account
  • • New email accounts must confirm their address before the session is usable
  • • Passwords are checked against known-breached credential lists at sign-up and change
  • • Google sign-in is available for organizations that centralize identity

Least privilege by default

  • • Anonymous callers have no read or write reach into any tenant table
  • • Internal authorization helpers are executable only by signed-in sessions
  • • The fictional demo tenant is strictly read-only; writes require real membership
  • • Audit events and employee responses cannot be updated or deleted at the privilege level

Data minimization

  • • No field exists for special-category data such as health or biometric information
  • • Customer content is never sold, used for advertising, or used to train models
  • • No score, ranking, or automated employment decision is produced about any person
  • • Retention periods and lawful basis are recorded per record type, per tenant

Shared responsibility

  • • Platform: hosting, managed database, encrypted transport and storage at rest, authentication, and row-level security enforcement.
  • • App owner: access reviews, retention and legal-hold configuration, sub-processor disclosures, the data processing agreement, and incident notification.
  • • Customer: keeping its people directory accurate, granting the minimum roles needed, and not entering special-category data into free-text fields.

Compliance frameworks such as SOC 2, ISO 27001, GDPR, HIPAA, and CCPA depend on organizational processes as well as software controls. Request the app owner's current compliance documentation before relying on any framework claim.