Signup Crew Security Statement

Our Approach to Security

Just Walking Ventures, LLC, doing business as Signup Crew (“Signup Crew,” “we,” “us,” or “our”), uses technical and administrative safeguards intended to protect customer, account, volunteer, RSVP participant, and other information processed through the Signup Crew Platform.

Security is an ongoing responsibility. No online service can guarantee absolute security, and this Security Statement does not create a guarantee, service-level agreement, certification, or warranty.

The safeguards described below apply to the features, information, and activities for which they are designed.

Connection and Hosting Security

Signup Crew is delivered using HTTPS/TLS to protect information transmitted between users and the Platform.

Vercel provides application hosting, content delivery, functions, and related operational infrastructure. Signup Crew maintains separate Development and Production environments and uses environment-specific configuration and credentials to help maintain separation between those environments.

Authentication and Account Security

Supabase provides authentication and session management for Signup Crew. Supported account access includes email and password authentication and optional Google authentication.

Password credentials are handled through Supabase authentication. Signup Crew's application database does not store plaintext passwords.

Platform-level Super Administrator access requires time-based one-time password (TOTP) multi-factor authentication and a corresponding higher-assurance authenticated session. Mandatory multi-factor authentication is not currently required for every customer account.

Authorization and Organization Boundaries

Signup Crew separates authentication from authorization. Being signed into an account does not, by itself, provide access to an Organization, event, or administrative function.

Depending on the applicable function, security controls may include:

• Organization-scoped authorization
• Database Row Level Security and restricted database operations
• Role and subscription-plan entitlement enforcement
• Additional restrictions for consequential Organization Owner and Super Administrator actions
• Event-specific role assignments
• Server-side revalidation for privileged operations

These controls are intended to help ensure that users access only the Organizations, events, information, and functions for which they are authorized.

Invitations and Account Activation

Organization and event access may be granted through scoped invitations.

Relevant invitation workflows verify information such as the invited email address, invitation status and expiration, Organization, assigned role, and current authorization state.

The application is designed not to display or store invitation credentials or authentication tokens in application logs.

Credentials and Service Integrations

Privileged service-provider credentials are maintained through server-side configuration and environment-management mechanisms and are not intended to be included in browser-delivered application code.

Signup Crew separates public client configuration from server-only credentials.

Where applicable, webhook requests from Stripe and Resend are verified using signed payloads before trusted processing. Provider identifiers, processing status, and appropriate failure information may be retained for delivery, reconciliation, security, and audit purposes.

Payment Security

Stripe provides hosted Checkout, payment processing, subscription billing, and Customer Portal services for Signup Crew.

Customers enter payment information through Stripe-hosted interfaces. Signup Crew does not store full payment-card numbers, CVV security codes, or bank-account credentials in the Signup Crew application database.

Signup Crew's use of Stripe does not represent that Signup Crew itself has obtained PCI or another payment-security certification.

Files and Communications

Supabase Storage is used for supported Organization branding, event images, and private communication attachments.

Private attachments are subject to applicable Organization and event scoping, server-side validation, and authorized access controls.

Resend provides email delivery for transactional and Organization communications.

Auditability

Signup Crew maintains records for selected security-relevant and consequential activities. Depending on the activity, these records may include administrative actions, roles and invitations, subscription and billing state, Organization lifecycle actions, and communication delivery information.

These records support investigation, reconciliation, security, and accountability. They do not represent that every action performed within the Platform is logged.

Service Providers

Signup Crew relies on established service providers for important portions of its technology and security infrastructure, including:

• Supabase for database services, authentication, sessions, multi-factor authentication, and file storage
• Vercel for application hosting, content delivery, functions, and operational infrastructure
• Stripe for hosted payment and subscription services
• Resend for email delivery
• Google for optional authentication when selected by a user

Each provider operates and maintains its own systems and security controls. A certification, assurance, or security standard maintained by a service provider does not automatically constitute a certification of Signup Crew.

Reporting Security Concerns

If you believe you have identified a security vulnerability or other security concern involving Signup Crew, please contact us at support@signupcrew.com. Using the subject “Security Report” can help us identify your message.

Please provide enough information for us to understand the issue, but do not send passwords, authentication tokens, full payment-card information, or participant information that is unnecessary to explain the concern.

Reporting a concern under this Security Statement, by itself, does not authorize access to information that is not yours, disruption of the Platform, or security testing. Any security research is governed exclusively by the Signup Crew Vulnerability Disclosure Policy and must remain within its authorized scope.

Signup Crew does not promise a specific response time or remediation service level through this Security Statement.

If Signup Crew determines that a security incident involving personal information requires notification, we will notify affected individuals, Organizations, regulators, or other appropriate parties as required by applicable law.

Scope and Limitations

This Security Statement describes security practices used by Signup Crew but does not constitute a representation of absolute security or a certification of the Platform.

Signup Crew does not claim:

• 100% or absolute security
• “Bank-level” or “military-grade” security
• SOC 2 certification
• HIPAA compliance
• PCI certification by Signup Crew
• Guaranteed uptime
• Guaranteed backup, restoration, recovery-time, or recovery-point objectives

Security practices, technologies, service providers, and safeguards may change as Signup Crew and the Platform evolve.

Changes to This Statement

We may update this Security Statement as the Platform and our security practices evolve.

When a change is material, we will provide notice appropriate to the nature of the change and applicable law. The effective date shown above identifies the version of this Security Statement then in effect.

Contact Us

For questions or security concerns regarding Signup Crew, please contact:

Just Walking Ventures, LLC
Doing business as Signup Crew
Email: support@signupcrew.com