Security
Control and provenance are the product, not an add-on.
Crescevo exists for systems where outputs must remain traceable, reviewable, and controlled. The security model reflects that.
Backend-enforced authority
The frontend never infers what is allowed. Every command is revalidated by the kernel against policy, authority, and workflow state.
Tenant isolation
Records are scoped to a tenant and isolated at the data layer. Cross-tenant access is denied and explicitly tested.
Host-only sessions
Authentication cookies are host-only and never set on a shared parent domain, so one surface cannot expose another.
Separated administration
Payload administration is a distinct identity boundary with its own access control, not shared with the console.
Isolated pre-production
Preview environments use separate databases, secrets, and credentials, and never share cookies or data with production.
Auditable change
Sensitive actions produce audit events. Decisions, commands, and effects retain who authorized them and what resulted.
Compliance
Formal certifications are listed here as they are achieved. We do not claim certifications we do not hold.
Responsible disclosure
To report a security concern, email[email protected]. We acknowledge and investigate legitimate reports and ask that you give us reasonable time to remediate before public disclosure.
FAQ
Security questions
Can a bug on one subdomain expose another?
Host-only cookies mean a session on one surface is not valid on another, limiting blast radius by design.
Are previews ever connected to production data?
No. Pre-production is fully isolated: separate databases, secrets, credentials, and cookies.