Security & data handling

Admin access & accounts

Administrative access to our Microsoft 365 environment uses multi-factor authentication (MFA) and Microsoft security defaults. Shared mailboxes are sign-in blocked, so they cannot be used to log in directly. Internal access follows least-privilege, role-based access principles. Where multi-factor authentication is used, it works with standards-compatible authenticator apps such as Microsoft Authenticator or Google Authenticator.

Website enquiries

Our forms are protected by Cloudflare Turnstile, a hidden trap field and rate limiting, to reduce spam and automated abuse. We practise data minimisation: we collect only the enquiry details you choose to provide, and we do not ask for worker documents or sensitive worker information at enquiry stage.

Data handling

Enquiry details are used only to respond to you and arrange a demo. If you move forward, we agree the setup process, access levels and data handling approach before any live worker records are added. A list of the third parties that may process data on our behalf is on our subprocessors page.

Infrastructure & hosting

The Crew Matrix website is hosted on Laravel Cloud. DNS, content delivery and edge TLS are provided by Cloudflare, and our business email runs on Microsoft 365. Traffic to the website is served over HTTPS, with TLS terminated at the Cloudflare edge, and every response carries a conservative set of security headers (including content-type, frame-ancestors, referrer and permissions policies). The providers that may process data on our behalf are listed on our subprocessors page.

Crew Matrix product controls

Controls that are in place in the Crew Matrix product today. We describe only what is actually implemented and do not claim controls we have not verified.

• Role-based access (company admin, compliance, site manager, worker)
• Site scoping - site managers see only their assigned sites
• Sensitive and identity evidence restricted from site managers
• Private document storage - evidence is not publicly accessible
• Administrative multi-factor authentication (Microsoft 365)
• Append-only audit history (recorded; not editable or deletable in the app)
• Worker record and report exports (your data is not locked in)
• Retention is admin-driven - no automated deletion of worker records

Being finalised, and published only once independently verified: the hosting region, the production database provider and the transactional-email provider, encryption-at-rest confirmation, backup and restore testing, our vulnerability-management process, and our written incident-response process. Ask us for the current position for a procurement review.

For security or procurement questions, email support@crewmatrix.co.uk.

Data protection registration & certifications

JOGANGROUP LTD is registered with the Information Commissioner's Office (ICO) under registration reference ZC195263 (registered 10 July 2026, renewal due 9 July 2027). ICO registration is the data protection fee and register entry required of organisations that process personal data. It is not a certification, approval, or endorsement of GDPR compliance.

Operator

Crew Matrix is a product operated by JOGANGROUP LTD, registered in England and Wales under company number 17067444.

Responsible disclosure & contact

If you believe you have found a security issue, please report it to security@jogan.co.uk and give us a reasonable opportunity to investigate and resolve it before disclosing it publicly. Data protection questions can be sent to privacy@jogan.co.uk.