Security and data
Plain answers about where your members' data lives and what we can and cannot do with it.
Where your data lives
Everything FedCrest builds runs in a cloud account that belongs to you, in a region you choose. You hold the administrator access from day one. We do not run your members' data in a system of our own.
What we can access
We work in your account through access you grant and can revoke at any time. We keep no copy of your data beyond what a support request needs while it is open. If you end the engagement, you keep the system, the data and the documentation.
Sign-in
Members and administrators sign in through the identity controls of your own account. You can require multi-factor sign-in for administrators.
Backups, updates and monitoring
The monthly retainer includes updates, backups and monitoring of what we built, with support by email.
Encryption
Traffic between your members and your system travels over HTTPS (TLS). Data at rest sits in your own cloud account, where major cloud providers encrypt storage by default. Ask us for the specifics of your setup and we will answer in writing.
Payments
When you pay FedCrest online, you pay on a page hosted by Stripe. Card details go to Stripe and never pass through our website or servers. In your own system, payments run through your own payment provider account, with no markup from us.
Roles under GDPR
You are the controller of your members' data. FedCrest acts as your processor under a data processing agreement, which we provide before work starts. You decide what data is collected and why.
Children and guardians
Registration can require guardian consent for minors and records it. You decide what is asked and how long data is kept. Check the age of digital consent that applies in your country with your own adviser.
For US organizations: under COPPA, collecting personal information from children under 13 requires verifiable parental consent. The guardian consent step in registration is built to support that. Which rules apply to your organization, and whether your process meets them, is for you and your own counsel to decide. This is not legal advice.
If something goes wrong
If we find a problem that affects your data, we tell you without undue delay and help you assess and report it. To report a vulnerability or a concern, write to [email protected].
What we do not claim
- We hold no security certifications, such as ISO 27001 or SOC 2, and have had no independent audit.
- We are a small independent studio, with no 24/7 support line. Support is by email, within two working days.
- The security of the underlying cloud account is shared with your cloud provider. We configure it carefully, and you remain responsible for who you give access to.
This website
This site sets no tracking or advertising cookies. It stores a technical copy of its pages in your browser so it works offline. See the legal notice and privacy policy and the cookie policy.
Last updated: November 2026.