Security & Trust

• All traffic to and from Crugex runs over TLS encryption.
• Passwords are stored only as salted cryptographic hashes — never in plain text, never recoverable by our team.
• Production data access is restricted to a small, named engineering group, over authenticated channels.

A skill becomes “Verified” on Crugex only through assessments taken on the platform — timed, timestamped, and recorded by Crugex itself rather than self-reported. Certificates reference the assessment that produced them, so a claim on a Crugex profile can be traced back to the result behind it.

As an Indian intermediary and service provider, we operate under the CERT-In Directions of April 2022:

• Security and system logs are retained for a rolling 180 days, stored on infrastructure physically located in India.
• Cyber incidents are reported to CERT-In within the mandated 6-hour window of detection.
• System clocks are synchronized to standard Indian time sources for reliable, consistent logs.

• Profile visibility — private, link-only, or shared with hiring partners — is always under your control in account settings.
• Recruiters see only the evidence you grant access to. Access is revocable at any time.

Found a vulnerability? We would rather know than exploit. Email security@crugex.com with details and steps to reproduce. We acknowledge reports within 72 hours, will not pursue action against good-faith research, and credit discoverers (with permission) once issues are fixed.

• Use a strong, unique password — you are the first line of defence for your proof.
• Never share your account or handle credentials; streaks and XP die with compromised accounts.
• Report anything suspicious through the in-app flag or our grievance channel.

Our handling of personal data follows the Privacy Policy under the DPDP Act, 2023 and DPDP Rules, 2025 — including Indian data residency, retention limits, and breach-notification duties. Questions? Write to grievance@crugex.com.