Security

Henshin holds account information and, for many customers, their own catalogue and sales data. Protecting that data is foundational to how we build the product, not an afterthought.

Every session requires authentication. Sessions are time-limited and refreshed automatically using industry-standard token practices, and credentials are never stored in the browser beyond what's needed to keep you signed in securely.

Each customer's workspace and data are logically isolated from every other customer's. Access within a workspace is scoped by organization and by the role assigned to each user.

All traffic between your browser and Henshin is encrypted using HTTPS/TLS.

The tooling our team uses to operate Henshin is a separate, internal-only system — it isn't reachable by customers or the public. Internal access follows least-privilege, role-based principles.

If you believe you've found a security issue, we want to know. Report it to hello@crystal.re. We commit to acknowledging good-faith reports promptly and won't pursue legal action against researchers who report responsibly and give us a reasonable chance to fix the issue before disclosing it publicly.

We don't hold formal third-party certifications such as SOC 2 or ISO 27001 today. As Henshin grows, we plan to pursue independent certification, and we'll update this page when that happens.

Questions about our security practices can be sent to hello@crystal.re.