Crevyro
Authentication & account checks
Customer APIs validate Firebase ID tokens, check allowed sign-in providers and verified-email state, and resolve the user and workspace on the server.
Firebase token validation · server-side identitySecurity at Crevyro
Real controls. No borrowed badges.
This page describes controls found in the current Crevyro implementation for sign-in, Instagram credentials, workspace access, APIs, webhooks, payments and hosting.
!Crevyro does not currently claim SOC 2, ISO 27001, PCI DSS certification, an independent penetration test or another certification that has not been earned and documented.
Implemented controls
Protection at the boundaries that matter.
Security is layered. A valid sign-in alone is not enough: the backend resolves the user and workspace, applies role and plan checks, scopes database work to that tenant and protects external-provider actions separately.
Instagram token protection
Stored Instagram access tokens and customer Meta secrets use AES-GCM encryption with workspace-and-purpose context, key versions and previous-key rotation support.
Applies to provider credentials · not a claim that every D1 field is encryptedWorkspace isolation
Customer operations use the server-resolved workspace ID. Tenant-scoped database queries, roles and plan checks limit which records and actions an authenticated user can reach.
Tenant-aware authorization · role checksLayered rate limits
Pre-authentication ingress, general workspace APIs, expensive actions, automation runs, webhooks, message sends and plan-bound Meta operations use separate limits.
Edge limits + exact D1 counters where consistency mattersVerified provider events
Meta and Razorpay webhook signatures are checked before events are accepted. Durable claims, inbox processing and idempotency records reduce duplicate execution.
HMAC verification · replay and duplicate controlsPayment separation
Razorpay handles payment-method entry. Crevyro stores the billing references and status needed for subscriptions, invoices, refunds and reconciliation—not complete card, bank or UPI credentials.
Signature verification · tenant-bound invoice accessA protected request path
From the browser to the provider.
The exact path changes by operation, but sensitive customer actions follow this basic sequence.
Authenticate
Validate the account token and sign-in requirements before customer data is accessed.
Authorise
Resolve the workspace, role, status, subscription entitlements and request scope on the backend.
Limit & validate
Apply body-size, input, rate-limit, ownership and provider-specific checks for the requested action.
Process safely
Use tenant-scoped records, protected credentials, signed provider events and bounded retries.
Infrastructure & operations
Controls beyond the request itself.
The supplied production configuration also includes protections around hosting, failures, retention and deletion. These reduce risk; they do not make any internet service invulnerable.
A deliberately narrow browser boundary.
Firebase Hosting sets HSTS, frame protection, MIME protection, a strict referrer policy, a permissions policy and an explicit Content Security Policy for the origins the product currently needs.
No Instagram password form.
Supported accounts connect through Meta authorization using one-time, expiring state rather than giving Crevyro an Instagram password.
Queues, retries and dead letters.
Webhook and automation work can survive temporary provider failures without depending on an open browser tab.
Redaction before storage.
Error handling removes common tokens, secrets, authorization headers, signatures and payload fields from recorded diagnostic text.
Cross-system cleanup.
Account deletion coordinates subscription cancellation, provider cleanup, Firebase identity removal and D1 workspace deletion with retry records.
Security information should age honestly.
This page is based on the current supplied source and deployment configuration. A future product change, provider setting or incomplete rollout can change the effective control. Crevyro therefore avoids guarantees of absolute security.
Contact support if a public statement appears inconsistent with what you observe.
Security FAQ
Questions worth asking before you connect.
For what information is handled, why it is needed, retention periods and deletion rights, read the full Privacy Policy.
Does Crevyro ask for my Instagram password?
No. Supported connections use Meta authorization and access tokens. Never send Instagram passwords, OTPs or access tokens through support or automation fields.
Are all database records encrypted field by field?
No such claim is made. The current implementation specifically encrypts stored Instagram tokens and customer Meta secrets. Other records rely on tenant authorization, infrastructure access controls and the service’s data handling rules.
Does Crevyro store my full card, bank or UPI credentials?
No. Payment-method entry and authorization are handled by Razorpay. Crevyro keeps provider references, amounts, currencies, status, invoice and refund information needed to operate billing.
Is Crevyro certified against a security standard?
Crevyro does not currently claim an independent SOC 2, ISO 27001 or PCI DSS certification. The controls described here are product and operational controls visible in the current implementation.
How should I report a suspected vulnerability?
Email srao2445@gmail.com privately with safe reproduction steps, impact and affected area. Do not include active credentials or publicly exploit the issue.