Data Security & Encryption

Data Security

CrownSync Playbooks is built with security at every layer. This page describes the technical and organisational measures in place to protect your data, including encryption, authentication, access controls, and infrastructure security.

Data at Rest

All data stored by CrownSync Playbooks is encrypted at rest:

• Database— PostgreSQL with full-disk encryption provided by the hosting infrastructure. All playbook content, organisation profiles, incident data, and audit logs are stored in the encrypted database.
• Infrastructure— Hosted on Hetzner Cloud in European Union data centres (Germany). Hetzner provides physical security, redundant power, and encrypted storage volumes.
• Credential encryption— Sensitive credentials such as integration API keys and webhook signing secrets are encrypted using AES-256-GCM before being stored in the database. Encryption keys are managed separately from the application database.

Data in Transit

All data transmitted to and from CrownSync Playbooks is encrypted using TLS 1.2 or higher:

• HTTPS is enforced on all connections. HTTP requests are automatically redirected to HTTPS.
• TLS certificates are managed through Cloudflare with Origin Certificates for the connection between Cloudflare and the origin server.
• API connections to external services (Resend, service desk integrations) use TLS encryption.

Authentication

User authentication is handled by CrownSync's self-hosted Authentik identity provider (single sign-on across all CrownSync products) using OpenID Connect. Authentication runs on CrownSync's own UK-managed infrastructure — no third-party identity service processes your credentials. It provides:

• Secure password hashing (argon2)
• Multi-factor authentication support
• Session management with secure, httpOnly cookies
• Brute force protection and rate limiting
• Account recovery and password reset flows

External Collaborator MFA

External collaborators who access the platform via magic links are required to set up TOTP (Time-based One-Time Password) multi-factor authentication. This is mandatory and cannot be bypassed. TOTP secrets are encrypted at rest using AES-256-GCM. See External Collaborators for details on the MFA setup process.

No Tracking Cookies

CrownSync Playbooks does not use tracking cookies, advertising pixels, or third-party analytics that track individual users. Analytics are provided by a self-hosted Plausible instance that collects aggregate, privacy-friendly metrics without setting any cookies or collecting personal data.

Infrastructure Security

• Application runs in isolated Docker containers with minimal base images (node:22-alpine)
• Reverse proxy (Caddy) handles TLS termination and security headers
• Cloudflare provides DDoS protection, WAF rules, and edge caching
• Server access is restricted to SSH key authentication only
• Regular security updates are applied to the operating system and all dependencies