Security Considerations When Using CrowdHandler

CrowdHandler is a software as a service (SaaS) offering focused on providing waiting room and access management functionality.#

We want to be transparent about our security practices and what data we collect to give our clients confidence in using our service.

While CrowdHandler operates on a shared responsibility model with our clients, we maintain rigorous security controls and compliance practices for our infrastructure and application. However, CrowdHandler is not a platform as a service (PaaS) - nor do we have direct access to client data or interact with their customers’ personally identifiable information (PII), with two exceptions:

1. When clients utilize our DNS implementation, CrowdHandler handles routing of traffic to origins. We discuss the security considerations of the DNS implementation separately.
2. We do store business user account information for our client's admins, including emails. However, this information is stored securely with AWS Cognito outside the core CrowdHandler domain and application.

Beyond these two scenarios, the only data CrowdHandler collects is the anonymous session information that our clients choose to send to our API in order to utilize our queueing and access management features. This includes an anonymous session token, IP address, browser information and URL. We do not connect IP addresses to any other identifying data. CrowdHandler does not collect or store credit card numbers, account information or other sensitive data. All billing is handled by a PCI-compliant third-party.

While IP addresses are considered PII in some cases, CrowdHandler only uses them internally for security monitoring and has no way to link them to a data subject’s real identity. Clients can also request to have IP addresses obscured if needed for their own compliance requirements.

We rely on clients to manage data collection, customer consent and compliance for their own systems and use of our services. CrowdHandler aims to be transparent about our security approach so we can work together with clients to meet their governance and compliance needs.