Security
Your numbers are nobody else’s business.
Crux OS holds the things a restaurant least wants leaked: salaries, margins, supplier prices, the real P&L. Here is how that data is protected, in plain English. Every claim on this page is true and tested, or it isn’t on this page.
Your data stays in Singapore
Crux OS runs on infrastructure in the AWS Singapore region. Client data sits in Singapore at rest, with no overseas transfer to think about.
One client, one instance
Every business on Crux OS gets its own isolated instance: its own database, its own logins, its own web address. There is no shared database where a bug could leak one client’s numbers to another. Your P&L cannot end up in someone else’s dashboard, because it doesn’t live in the same place.
Access is enforced at the database, not just the app
Crux OS has three access levels: Director, Manager and Staff. What each level can see is enforced by rules inside the database itself (row-level security), so a staff login cannot read salaries or P&L even if the app in front of it misbehaves. Salaries, claims and financials are Director-level by default.
Locked doors by default
- Every connection is encrypted in transit.
- Passwords are handled by the authentication layer and never stored in plain text.
- There is no public sign-up. Accounts exist only when a Director creates them.
- Uploaded documents, like invoice scans and receipts, live in private storage, not on public links.
Clock-in location, without tracking
GPS is captured at the moment a staff member punches in or out, to confirm they’re at the shop, and that’s it. Crux OS never tracks anyone’s location between punches. Staff phones are not being followed.
No trackers, no ad pixels
This website runs no analytics, no advertising pixels and no cookies. Crux OS itself contains no third-party trackers either. We sell software, not your attention.
We test it ourselves
We regularly probe our own systems the way an outsider would: checking that locked tables stay locked, that API routes reject strangers, and that one instance cannot see another. Findings get fixed, then re-tested.
If something goes wrong
If a breach ever puts your data at risk, we tell the affected business directly, and the Personal Data Protection Commission where the law requires it. Our Data Protection Officer is registered with the PDPC and reachable at hello@cruxsg.com. The full detail lives in our privacy policy.
No badges we haven’t earned
You won’t find certification logos here that don’t mean anything. When Crux holds a certification worth showing, it will appear on this page, and it will be checkable. Until then: just the facts above.
Questions about any of this: ask the operator, not a support queue. hello@cruxsg.com