CrewCard Security FAQs

CrewCard uses multiple security controls to protect information across its platforms. The safeguards described in CrewCard's current security information include SSL/TLS, encryption at rest, firewalls, login protection, security warning emails, two-factor authentication, multi-factor authentication, server monitoring and backup controls.

Yes. CrewCard uses SSL/TLS to secure data transmitted between a user's browser and CrewCard's web services. A secure connection can typically be identified by https:// in the address bar and the browser's security indicator.

Encryption at Rest is used as an additional protection for data stored on hosting infrastructure and backup media. The purpose of this control is to reduce the risk of unauthorised access to stored information if physical storage media is compromised.

CrewCard's Privacy Policy is available online and explains how personal information is handled.

CrewCard limits repeated unsuccessful login attempts. Under the current security rules described for CrewCard accounts, four consecutive attempts are allowed and a fifth unsuccessful attempt triggers a temporary 15-minute block. This control is intended to reduce the risk of brute-force password attempts.

CrewCard can send a security warning email when an account is accessed from a new device. The message is sent to the email address registered to the account and provides information about the sign-in. It also provides a way to change the password if the user does not recognise the activity.

Yes. CrewCard provides two-factor authentication that can be enabled from the relevant security settings. When active, supported users such as Admins, Superusers, Duty Managers and Crew are required to complete an additional verification step when signing in.

Access to the Payroll Portal is limited to users who have been granted permission by an Administrator. This helps restrict payroll, taxation and accounting information to authorised users.

After entering a username and password, the Payroll Portal requires an additional six-digit verification code. The current security information states that the code can be delivered by email, SMS or an authenticator application, depending on the configured method.

No. The current Payroll Portal security rules are designed around individual user access. The portal allows one active login so that the same user account cannot be used concurrently in another browser or on another device.

Yes. The current Payroll Portal configuration includes a maximum idle session timeout of 15 minutes. If the user remains inactive for that period, the session is automatically ended and the user must sign in again.

The current Payroll Portal security information states that the Remember Me function is limited to 24 hours.

The current Payroll Portal security information states that a user is locked out after four invalid password attempts. This helps reduce the risk of repeated password guessing.

CrewCard's current security information states that its affiliated payroll package, CrewPayer, supports Single Touch Payroll and has undergone extended conformance testing associated with Australian Taxation Office requirements. The payroll hosting environment is also described as being located in Australia.

CrewCard's current security information describes regular monitoring for server availability, load spikes, spam activity and backup status. The purpose of these controls is to identify service or security issues early and support continuity of the platform.

The hosting environment is described as using Imunify360. Its listed controls include an advanced firewall, intrusion detection and intrusion prevention features that monitor for suspicious activity and help block recognised attack patterns.

Imunify360 is described as providing automated malware scanning across the server file system. Where malware is detected, the security platform can quarantine affected files as part of its protection process.

The current server security information describes Imunify360 Proactive Defence as a control designed to identify and block potentially malicious executions in real time, including activity associated with previously unknown or zero-day attacks.

The server environment is described as using KernelCare for rebootless kernel patching. This allows certain security updates to be applied without requiring a full server reboot.

Yes. The current server security information describes website reputation monitoring that checks whether the domain appears on recognised blocklists and provides notification if an issue is detected.

CrewCard's current security information states that the server is backed up and replicated to a separate server dedicated to backups. This is intended to support data protection and recovery in the event of an incident.

CrewCard's current security information links to a network status and maintenance service that provides updates about potential disruptions and scheduled maintenance.