One employee record underneath
Every module reads the same person, the same team and the same permissions. Switching one on adds capability rather than another system to keep in sync.
Resources
How Crewzy fits together, and how it is protected.
Two things worth understanding before you commit a company to a platform: how the modules relate to each other, and what actually guards your data.
How modules work
Add a module, not another integration.
Every module runs on the same employee record and the same permissions, so switching one on adds capability instead of another system to wire up and keep in sync.
Permissions travel with the person
Access is evaluated from company-scoped role grants, so turning on a module never means re-granting everyone access to it separately.
Turn one on, turn one off
Modules are enabled per company. What you do not use stays out of the way instead of cluttering every screen.
Data crosses without an integration
Approved leave reaches the timesheet, approved time reaches the invoice. No connector to configure, no sync to monitor, no mapping to maintain.
Security & trust
Controls that are in the product today.
Everything below is implemented and running, not on a roadmap. Where we do not yet have something, it says so.
Access control
Every API request is authorised against company-scoped role grants rather than a client-side check, and object-level ownership is verified separately from the route guard.
Separation of duties
Sensitive approvals apply maker-checker rules, so the person who raised a request cannot be the person who approves it — enforced on the server, not hidden in the UI.
Audit trail
Connected services record actor, company, action, result and time — including refusals, not only successes — so an investigation can show what was attempted as well as what happened.
Sign-in protection
Multi-factor authentication with authenticator apps, email fallback and backup codes, plus account lockout after repeated failed attempts.
Tenant isolation
Every query is scoped to the company it belongs to, and services re-verify that scope rather than trusting an identifier supplied by the caller.
Service hardening
Standard security headers, per-endpoint rate limiting on write paths, and a fail-closed configuration check that refuses to start on a weak or missing production secret.
What we do not claim yet. Crewzy is not SOC 2 or ISO 27001 certified — those audits take a trading history we do not have. The controls above are built and running, and we will happily walk your security team through how each one works. If a certificate is a hard requirement for you today, we are not the right choice yet, and we would rather tell you now.
Ready when you are
See it running on your own data.
Start free for up to 10 employees, or ask us to set a workspace up with your people already in it.