What we actually do with your specs.
Crossary maps from specifications — schemas, data dictionaries, implementation guides — not from your production records, so in most cases there's nothing sensitive to upload in the first place. Here's how the rest is handled.
Uploaded artifacts and exports live in EU object storage; the application and its PostgreSQL database are hosted in Frankfurt. AI inference and payment processing are performed by providers that may operate in the United States — see the subprocessor list below.
Every workspace-scoped request resolves the signed-in user's membership before reading a row, and a request for something you're not a member of returns 404 rather than 403 — endpoints aren't existence oracles. Static guards in the test suite assert that every workspace route and page does this; a runtime two-tenant test proves it end to end.
Passwords are hashed with bcrypt and never stored in plain text; sessions are HTTP-only, Secure cookies. Sign-in is throttled on three independent windows — per IP, per email-and-IP pair, and per email — so credential stuffing is capped without letting an attacker lock a real user out of their own account. Over-limit is indistinguishable from a wrong password, so it can't be used to enumerate accounts. Password-reset links are single-use and expire in 30 minutes.
TLS everywhere, HSTS enabled, and an enforced security-header set: a strict Referrer-Policy, X-Content-Type-Options: nosniff, and X-Frame-Options: DENY. A Content-Security-Policy is also deployed, in report-only mode, while we watch real traffic for violations before enforcing it.
Artifacts are size-checked before they are read, and archive formats are screened for declared-size zip bombs. Files that can't be decoded are reported as unreadable rather than silently half-ingested.
Application errors are captured by an EU-hosted error monitor. The managed database is backed up by the hosting provider on its standard schedule.
What we don't claim
Crossary is operated as a sole trader established in Portugal. If your review requires any of the following today, we are not yet the right fit and we would rather you know now:
- SOC 2, ISO 27001, or any third-party security certification
- A published penetration-test report
- A contractual uptime SLA
- Single sign-on (SAML/OIDC) or SCIM provisioning
A data processing addendum is published and applies automatically; enterprise customers who need a counter-signed copy or their own paper can email us at support@crossary.com.
Where your data goes
Every third party that touches service or customer data, and where it operates. We give notice before this list changes.
| Provider | Purpose | Location |
|---|---|---|
| OpenAI | AI inference — field extraction & mapping suggestions. Prompts (which may include uploaded spec content) may be retained by OpenAI for a limited period (up to ~30 days) for abuse monitoring, then deleted; API data is not used to train shared models. Deleting an integration in Crossary does not purge any copy already processed by OpenAI. | United States |
| Cloudflare (R2) | Object storage for uploaded artifacts & exports | European Union |
| Render | Application hosting & managed PostgreSQL database | Frankfurt, EU |
| Stripe | Payment processing & subscription billing | United States |
| Purelymail | Transactional email delivery (SMTP) | United States |
| Sentry | Application error monitoring | European Union (EU data residency) |
| PostHog (EU Cloud) | Product analytics — cookieless pageviews & product events (no cookies, no advertising, no cross-site tracking) | European Union (Frankfurt) |
Full detail lives in the privacy policy and the subprocessor list. Questions we haven't answered here: support@crossary.com.