Security
Security controls and compliance status, clearly stated
Review Crownvo's current product controls, compliance-supporting workflows, and the certifications the company does not yet claim.
Compliance status
Useful controls without overstated certification claims
Crownvo provides product features and legal materials that can support customer compliance work. A supported control is not the same as independent certification.
GDPR-supporting workflows
Contact export, deletion, consent, suppression, and data-processing materials support customer privacy workflows. Crownvo does not describe this as third-party GDPR certification.
Email compliance controls
Unsubscribe handling, suppression, sending-domain controls, bounces, complaints, and feedback loops support responsible commercial email operations.
Data processing terms
Crownvo publishes privacy, DPA, cookie, and subprocessor information for customer review and contracting discussions.
SOC 2
Crownvo does not currently claim a completed SOC 2 audit. Contact security for the current readiness position and available control evidence.
ISO 27001
Crownvo does not currently claim ISO 27001 certification. Any future certification will be published only after independent confirmation.
Security review support
Prospective customers can contact security for current architecture, control, data-handling, and vendor information relevant to their evaluation.
Identity & access
Give people the access their role requires
Crownvo separates platform, agency, workspace, and hosted-mail responsibilities and resolves access against account membership and permissions.
Two-factor authentication
Workspace account settings include a dedicated two-factor authentication surface.
Role-aware workspaces
Owner, Admin, Editor, Analyst, and Viewer roles shape operational access inside customer workspaces.
Mail administration roles
Hosted mail uses separate Super Admin, Administrator, Operator, and Auditor roles with explicit mail permissions.
Agency and client separation
Agency operations and client workspaces use distinct route scopes and membership-aware destinations.
Data & tenancy
Keep customer work inside the correct workspace
Workspace APIs, repositories, and navigation are tenant-scoped so customer records and operations are resolved in the correct account context.
Tenant-scoped workflows
Contacts, conversations, campaigns, payments, files, and other modules operate under a workspace scope.
Controlled file access
The File Manager is designed around private object storage, metadata, quotas, signed downloads, scanning, and safe read-only modes.
Protected integration settings
Integration manifests distinguish secret credentials from non-secret configuration and apply explicit capability grants.
Activity visibility
Workspace and agent activity surfaces help authorized operators review operational changes and agent behavior.
Operational safeguards
Protect production paths and external side effects
The backend includes production configuration guards, billing state controls, mail-sending guards, and explicit operating modes for managed capabilities.
Production configuration guards
Automated backend checks cover production configuration and outbound platform email safeguards.
Billing state controls
Subscription and payment flows use provider-aware state handling, webhook processing, and idempotency records.
Safe capability modes
Managed modules define enabled, read-only, and disabled behavior so existing authorized data can remain accessible during operational changes.
Sending safeguards
Workspace sending includes domains, server routes, usage limits, warm-up, bounce handling, complaints, and feedback-loop controls.
Security responsibilities stay visible
Account owners can see the controls that affect people, customer data, sending, integrations, and billing instead of relying on hidden defaults.
For account owners
Manage team roles, account security, domains, connected systems, and plan-level capacity from dedicated settings surfaces.
For agencies
Keep agency operations separate from tenant-scoped client workspaces and control who can access each account.
For operators
Use explicit infrastructure, billing, mail, and integration controls with permission-aware access.
For reviewers
Read-oriented roles and activity surfaces support oversight without granting every operational permission.
Security questions, answered
The questions we get most from security and compliance teams. For anything else, email security@crownvo.com.
Questions about compliance?
Talk to our team about your security requirements and the current controls relevant to your deployment.
Credit card required · Trials of at least 14 days on paid plans