Data handling
Last updated 22 October 2026 · Version 2026-10-22
This page explains in plain terms how CrackOn looks after the data your business keeps in it. It forms part of our terms and privacy policy.
Where data lives
- Database and application servers: Sydney, Australia (Neon Postgres and Fly.io, Sydney region).
- Files (photos, documents, PDFs) are stored in Cloudflare R2, served over Cloudflare’s network.
- Backups: the database provider keeps point-in-time restore, and we keep a nightly copy in separate storage.
How it’s protected
- All traffic uses HTTPS. Data is encrypted at rest by our providers.
- Every business’s records are separated by row-level security in the database, so a bug in one screen can’t show one business’s data to another.
- Role-based permissions inside each business (owner, admin, office, technician, subcontractor). Subcontractors don’t see customer contact details or pricing.
- Passwords are hashed with Argon2id; sign-in links expire quickly; sign-in attempts are rate limited.
- An audit log records who changed what.
- Access to production systems is limited to the people who run CrackOn, and used only to provide support or fix problems.
Sub-processors
These providers process data so CrackOn can work. We’ll update this list, with a new date, before adding a provider that processes customer records.
| Provider | What it does | Where |
|---|---|---|
| Neon | Database hosting | Sydney, Australia |
| Fly.io | Application servers | Sydney, Australia |
| Cloudflare | Web hosting, file storage (R2), DNS and network security | Global network |
| Resend | Sending email | United States |
| ClickSend | Sending text messages | Australia |
| Stripe | Card payments, when a business turns them on | Australia and United States |
| Sentry | Error monitoring (technical details of errors, which may include an account ID) | United States |
| Google Maps Platform | Address suggestions and map coordinates | United States |
| GitHub | Running the nightly backup job (data passes through, isn’t kept) | United States |
Services a business connects itself, such as Xero, Jobber or ServiceM8, receive or send data only when the business asks, under that service’s own terms.
Acceptable use
Using CrackOn means following the acceptable use rules in section 5 of the terms: lawful use only, no spam, no attempts to access data that isn’t yours, and no disrupting the service.
Getting your data out
Businesses can export customer segments as CSV and download documents such as invoices and reports from the app today. Until a full self-serve export is available, email hello@crackon.au and we’ll provide a complete export of your business’s data.
Security issues
If you think you’ve found a security problem, please email hello@crackon.au with details. We’ll respond quickly and won’t take action against good-faith research.