Security

How CrewPipe protects your Jobber and HubSpot data, in plain words.

Connecting

• We connect to both platforms only through their official sign-in (OAuth). We never ask for or store your passwords.
• We ask for the smallest set of permissions the features you use need, and list them on our marketplace listings.
• Access tokens for both platforms are encrypted at rest with AES-256-GCM, and never written to logs.

What we keep

• Record ids, one-way fingerprints of synced values, statuses, dates, amounts and counts. Names, emails, phones, addresses and notes stay in Jobber and HubSpot.
• Our logs strip emails, phone numbers, tokens and record ids before they are written.

Keeping companies apart

• Every query is limited to the signed-in company's own data, and automated tests check that one company can't read another's.
• Every page and action checks who is signed in on the server, not just in the browser.
• Incoming messages from Jobber and HubSpot are only accepted with a valid signature.

Infrastructure

• Everything is sent over HTTPS. Hosting on Netlify, database on Neon (Postgres, encrypted at rest), both in the US.
• Card payments are handled by Stripe; we never see card numbers.
• Public forms are rate-limited; sign-in links expire quickly and work once.

Found a problem?

Email hello@goldstandardweb.com with “Security” in the subject. We answer within one business day and fix confirmed issues fast.