For security teams
Security and your data
Crowdboard keeps as little as a game needs. Hosts sign in without passwords, players don’t sign in at all, and each team’s games and results stay with that team.
At a glance
No passwords
Hosts sign in with a one-time code, Google, Microsoft or their company’s own sign-in.
Players stay anonymous
A name and a team. No account, email, phone number or location.
Each team kept apart
A team’s games, results and surveys reach only its own members.
Encrypted in transit
HTTPS only, and secure WebSockets for the live game.
Backed up every night
To separate storage, kept 29 days, with restores rehearsed on every release.
Yours to delete
Close an account from the app, and it’s gone within 30 days, backups included.
Filling in a security questionnaire?
Everything on this page as plain text, ready to paste into a questionnaire or an email, with a link back here.
Where it runs
- Crowdboard runs on Cloudflare: the app and its API on Cloudflare Workers, accounts and team libraries in a Cloudflare D1 database, and each live game in its own room on Cloudflare’s network.
- Resend sends the emails. Paddle takes payments as the merchant of record. If a host signs in with Google, Microsoft or their company’s own sign-in, that provider confirms who they are. If a host asks for a game drafted from a topic, Anthropic receives only the topic they typed and the number of rounds, nothing about players or accounts. No other company handles the data.
- There are no ads, trackers or third-party analytics. Cookies only keep hosts signed in.
Signing in
- There are no passwords. A host signs in with a 6-digit code sent to their email. It works for 10 minutes and 5 tries, and is stored only as a hash.
- No address gets more than 8 codes an hour, and sign-in requests from any one network address are rate-limited.
- Hosts can also sign in with Google or Microsoft. Crowdboard receives their name and email address, and no access to the account.
- On Enterprise, a team can sign in through its own identity provider, such as Microsoft Entra ID, Okta or Google Workspace, using OpenID Connect with PKCE. The company proves it owns its email domain with a DNS record.
- A team can make its company sign-in the only way in for its people. Owners keep their email code, so a mistake in the provider’s settings can’t lock the team out. The provider’s client secret is stored encrypted.
- A signed-in session ends when the host signs out, or 30 days after it was last used.
Teams and roles
- Each team’s games, results, surveys and settings can be reached only by its members. Every request is checked against the signed-in host’s team.
- Owners can do everything, including changing the plan and handing the team to someone else. Admins run games, invite people and change their roles. Hosts run games and open rooms for phones.
- Invitations go to one email address and run out after 7 days. A team holds only as many people as its plan has hosts.
- The team page keeps an activity log of who invited, removed or changed the role of whom, and of changes to the plan, company sign-in and branding.
Players and live games
- Players need no account. They type a name and pick a team: no email, phone number or location. A room forgets its players within 24 hours of last being used.
- Only the host’s deck holds the room’s key. The TV board and the phones get the room code, which lets them watch and play but not run the game.
- By default, phones that arrive after the game starts ask to join, and the host lets them in or turns them away. The host can also stop new phones joining at all.
Encryption and secrets
- Every page, API call and live game goes over HTTPS or secure WebSockets, and browsers are told to use nothing else for 365 days, on crowdboard.app and every subdomain (HSTS).
- Sign-in codes are stored only as hashes. Company sign-in secrets are stored encrypted.
- Card details never reach Crowdboard: Paddle takes them on its own checkout.
- Backups are stored in Cloudflare R2, which encrypts everything it stores.
Backups and recovery
- The database is backed up every night to separate storage, checked row by row once it’s written, and kept 29 days.
- Restoring is rehearsed on every staging release: the newest backup goes into a fresh database, and every table and link between tables is checked.
- Cloudflare’s point-in-time restore can also put the database back as it was at any minute of recent days.
Keeping and deleting data
- A host can close their account from the app at any time. It’s deleted within 30 days, including from backups.
- Game results stay until the game’s host, an owner or an admin deletes them. A team keeps its latest 5,000 games.
- Server logs are kept for a few days. The privacy notice lists everything that’s kept, and for how long.
In the browser
- Security headers stop other sites from showing the app inside a frame, and switch off the camera, microphone and location.
- When the app hits an error, the report it sends has email addresses and long numbers taken out.
- Nothing is installed on phones, laptops or TVs: everything runs in the web browser.
Certifications
- Crowdboard doesn’t hold its own certifications, such as SOC 2 or ISO 27001, yet. Cloudflare, which hosts it, holds SOC 2 Type II and ISO 27001, and Paddle is certified to PCI DSS for payments.
Reporting a security problem
- Write to support@crowdboard.app with “Security” in the subject. Please give us the chance to fix it before telling anyone else.
- Security tools can find the same contact at https://crowdboard.app/.well-known/security.txt.
The privacy notice lists what’s collected and how long it’s kept, and Crowdboard on a company network lists what a filtering network has to let through. Other questions: write to support@crowdboard.app.