Security Policy

Infrastructure
Hosting and data location

crossband.io is hosted on Google Cloud. Customer data, including backups and uploaded files, is stored in the United States. When a feature uses an AI model, the relevant content is processed by our AI providers, which may process it in the United States or other countries. Customers with specific data residency requirements should contact us before uploading data.

Controls
Data protection and access

• Data is encrypted in transit and at rest, and sensitive fields are additionally encrypted by the application.
• Sign-in is handled by Google's authentication service; crossband.io does not store passwords.
• Each user can access only their own data and data explicitly shared with them.
• Administrative access to production systems is restricted and protected by multi-factor authentication.
• The application is developed and reviewed against recognized secure-development practices, including the OWASP Top Ten.

Confidentiality
AI providers

AI features use Anthropic's Claude and Google's Gemini, through each provider's commercial service. These are the only AI providers crossband.io uses.

• Neither provider trains its models on crossband.io customer content.
• Google has granted crossband.io an exemption from prompt logging for abuse monitoring.
• For security purposes, Anthropic retains inputs and outputs only for a limited period under its standard commercial terms.
• crossband.io does not train models on customer content and does not sell it.

Transparency
Service providers

crossband.io uses service providers for cloud hosting and storage, sign-in, AI processing, email delivery and website analytics. Each is bound by data-processing and security terms. Some features also search public research databases, which receive only search queries. A list of service providers is available on request.

Process
Vulnerability management

Vulnerabilities are identified through code review, dependency monitoring, provider security notices and reports from users and researchers. Each is assessed for severity and remediated in order of priority, with critical and high-severity issues addressed as soon as possible. The underlying infrastructure is maintained and patched by our hosting provider.

Process
Incident response

crossband.io maintains an incident response procedure covering containment, investigation, notification, recovery and review. If an incident affects your data, we will notify you without undue delay and will notify regulators as required by applicable law.

Resilience
Backups and continuity

The database is backed up daily and supports point-in-time recovery. crossband.io maintains a business continuity and disaster recovery procedure, and the service runs on managed infrastructure that can be restored from backup.

Data
Retention and deletion

Your data is kept while your account is active. You can delete your account and its data at any time from your profile page, or by contacting support (at) crossband.io. Deleted data is removed from our systems, including backups, within 30 days.

Integration
Clio

Connecting Clio uses Clio's own sign-in; crossband.io never sees your Clio password. crossband.io accesses only the matters and documents you choose and stores its Clio credentials encrypted. Documents imported from Clio are deleted once they have been analyzed. When you disconnect Clio, crossband.io deletes its Clio credentials and its analysis of the documents imported from Clio.

Assurance
Compliance

crossband.io handles personal information in accordance with applicable privacy law, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA); see our Privacy Policy. Our infrastructure and AI providers maintain SOC 2 and ISO/IEC 27001 certifications. Further security documentation is available to customers and prospective customers on request.

Contact
Reporting a security issue

If you believe you have found a security vulnerability, please email support (at) crossband.io with a description and steps to reproduce it. Please do not access or change other users' data, and allow us a reasonable time to fix the issue before disclosing it publicly.