Security

Encrypted connections

Every page and the app use HTTPS only. The connection between our app and its database is encrypted too.

Encrypted storage

Our host encrypts the database and its backups on disk. On top of that, Cronta encrypts documents (payslips, contracts, notes from a doctor and other files), ID numbers and two-step sign-in secrets with AES-256 before they are saved, using keys kept separately from the database. A copy of the database alone doesn't show them.

This encryption started in November 2026. Files saved before then are encrypted by a background job; older copies kept in our host's own backups expire on their normal schedule.

This is encryption on our servers, not end-to-end encryption: the app holds the keys, so it can show each file to the people allowed to see it. Names, hours, locations of punches and pay are protected by the host's disk encryption, encrypted connections and our access rules, but are not encrypted separately, because the app has to sort and add them up.

Passwords and PINs

We never store a password or PIN, only a one-way hash of it. Wrong guesses are limited: after a few, sign-in waits 15 minutes.

Where the data lives

• Vercel: runs the app.
• Supabase: the database (United States, us-east-1).
• Stripe: payments. We keep no card details.
• Resend: alert emails, if a business turns them on.

The Privacy Policy lists everyone who handles data for us.

Who can see what

• Each business's data is kept apart from every other business's.
• People with Full access or Admin see their business's people, hours, pay and documents.
• Store managers see the people and hours of their stores, not pay or payslips.
• Employees see only their own records and the documents shared with them.
• Our staff: only the founder has access to the live system, and uses it only to fix a problem you reported or when the law requires it.

Backups

Our database host makes automatic backups, kept for a limited time and encrypted. People with full access can download all their business's data at any time (Settings › Records and privacy).

If something goes wrong

If we find that someone got to data they shouldn't have, we tell the businesses affected without undue delay (our aim: within 48 hours of confirming it), say what happened and what to do. The business then informs its staff or authorities as the law requires.

Your choices

• Turn on two-step sign-in for everyone who signs in to the dashboard (Settings › Your account).
• Download a copy of all your data any time (Settings › Records and privacy).
• When a business closes its account, we delete its data within 30 days, as the Privacy Policy says.

Report a problem

Found a security problem? Tell us: contact address not set yet. Please don't access other people's data while checking.