Security at a glance
Your accounts are never touched
Crwl never asks for your LinkedIn login, Sales Navigator seat or browser cookies, and never logs in as you. There is nothing on your account to flag or restrict.
Encrypted in transit, encrypted in backup
TLS 1.2+ for every connection, and off-site backups are encrypted (names and contents) before they leave the box. Passwords and API keys are stored only as hashes.
Keys you control
API keys are shown once, stored as a hash, scoped read or read+write, and revoked from Settings at any time.
Signed webhooks
Every webhook carries an HMAC-SHA256 signature and a timestamp so you can verify it came from Crwl and reject replays.
Spend you can cap
Every run shows its plan and maximum price first, and nothing runs until you approve. A daily per-workspace cap refuses runs that would overspend, unless you opt into overage.
Deletion that sticks
Delete a list and it's gone. People who ask to be removed go on a suppression list so future runs skip them.
Infrastructure
- Hosted on dedicated servers at Hetzner in Falkenstein, Germany, on mirrored disks.
- Nightly encrypted, off-site backups of the database and volumes, with a restore drill that passes (last run 3 Nov 2026).
- Production is isolated from development, and secrets live in a managed secrets store rather than in git.
- Front-end dependencies are pinned by lockfiles and installed with
npm ci; the app is rebuilt from a clean environment on every deploy.
Access
- Production SSH is key-only (password login disabled) behind a default-deny firewall, with unattended security updates and fail2ban.
- Staff access is limited and only used to resolve a support request you open, or to investigate abuse.
- Settings has a two-factor authentication toggle for your own account, using your authenticator app.
Data handling
- Crwl collects publicly available business information only, from the sources you choose.
- Emails are verified before delivery; invalid addresses are dropped and never billed.
- Lists belong to you. Export them anytime, delete them anytime.
- Anyone can ask to be removed. See how removal works.
Compliance
We design for GDPR, UK GDPR and CCPA/CPRA. The Data Processing Addendum and subprocessor list are on this site. SOC 2 Type I has not been completed yet; the report will be linked here when it is.
Report a vulnerability
Email security@crwl.ai with steps to reproduce. We reply within 2 business days, keep you updated while we fix it, and won't pursue good-faith research that respects customer data and stays within our scope.
Need a security review?
We'll answer your questionnaire and share our DPA.