Built for the buyers who ask hard questions.

Every customer table is protected by Postgres row-level security. A workspace can only ever read its own rows — enforced at the database, not just the app.

The browser only ever holds an anon key scoped by RLS. The service-role key is server-only and never shipped to the client.

Owner, admin, member, and viewer roles gate every mutation. Privileged actions require owner/admin, and a workspace can never be left without an owner.

Budget changes, brand-setting changes, team membership, and published fixes are recorded to a tamper-evident audit log visible in-app.

The personal data we hold includes your sign-in email and the name, email and answers you submit on our forms. In our database, the IP address recorded with a form submission is stored as a hash, salted with a secret and the UTC date. API rate limiting keeps counters keyed by the requester's IP address. Your data is never used to train models.

Crescive reads answer engines through official provider APIs — no scraping, no ToS or CFAA exposure. Crawler traffic is verified against published IP ranges.

SAML SSO is available for enterprise workspaces via your identity provider (Okta, Entra ID, Google Workspace).

The controls above form the control base for SOC 2. Type II examination is on the roadmap; the trust surface it depends on is already built.