Draft · being reviewed before launch
Security
Updated October 26, 2026
Each business stays separate
Every request is checked against the signed-in person’s membership of the business they’re asking about, on the server. Knowing another business’s ID gets you nothing.
Roles
Owners, office and crew see what their role allows. Crew see their own jobs and hours; money and settings are for owners and the office.
Sign-in
Passwords are at least 12 characters and stored only as salted hashes. New accounts confirm their email with a code. Sessions end after 7 days, or a day without use. Sign-up is checked against bots.
Data in transit and at rest
All traffic uses HTTPS. Records and files are stored with providers that encrypt data at rest. Files are reached only through short-lived signed links.
Payments
Card details are entered on Stripe’s own checkout and never reach Crewbird. Payment records are written once per payment and can’t be deleted once confirmed by Stripe.
Our access
Internal admin tools sit behind Cloudflare Access. Secrets are kept in our providers’ secret stores, never in code. Staff look at customer data only to support you or keep the service secure.
Reporting a problem
Found a security issue? Write to hello@thora.cloud. Please give us a chance to fix it before telling anyone else, and don’t access other people’s data while testing.