Trust & Security Center
You’re about to hand a partner the keys to your business. It’s fair to ask how they are secured. This is our own posture, in one place — the attestations, the controls, the agreements we’ll sign, and the reason we keep some things deliberately quiet.
The short, honest version
CRC Cloud is not SOC 2 attested and not ISO 27001 certified. The datacenter that houses our hardware is — those are the facility operator’s credentials, and we will not borrow them. Our own practice is organized around the NIST Cybersecurity Framework 2.0, and everything below describes what we actually do rather than what someone else has certified.
We are telling you this in the first paragraph instead of the fine print because you are about to hand a partner the keys to your business, and you should not have to dig for the one fact a competitor would most like you to miss. If a certification is a hard requirement for your firm, say so on the assessment call and we will tell you plainly whether we are the right fit — sometimes the honest answer is that we are not.
How we secure our own house
We hold ourselves to the standard we sell. The pillars:
The facility, on the record
Your data can live in a carrier-neutral Southern California datacenter engineered to a concurrently maintainable design, with N+1 redundant power and cooling. Its operator holds SOC 1 & SOC 2 Type II attestations, ISO 27001 and PCI DSS certifications, and NIST 800-53 (PE) High alignment.
Tested resilience
Encrypted backups with the most recent 30 days locked against change or deletion, a nightly copy at a second site we operate — a separate access-controlled building in the same region — and quarterly test restores: the recovery discipline we require of clients, applied to ourselves.
24/7 monitoring
Every environment we manage is monitored around the clock. On Secure IT, a security operations center watches it too, with managed detection and response and centralized SIEM logging behind it.
Hardened access
MFA on administrative access, least-privilege by default, encryption in transit and at rest, and a NIST Cybersecurity Framework 2.0-based practice governing how we operate.
Attestations & alignment
What underpins the infrastructure your workloads run on:
| Standard | Who holds it & what it covers |
|---|---|
| SOC 1 & SOC 2 Type II | Independent audits of the facility’s security, availability, and controls over time |
| ISO 27001 | An internationally recognized information-security management standard |
| PCI DSS | Payment-card data-security requirements at the facility level |
| NIST 800-53 (PE) High | Physical and environmental controls aligned to a federal high-impact baseline |
| Concurrently maintainable design | Power and cooling can be serviced without shutting systems down |
| Ours | What it covers |
|---|---|
| NIST CSF 2.0 | The framework our own security practice is organized around |
| 99.9% uptime | The service level our hosted systems carry — our own commitment |
We’ll tell you which facility certifications and reports apply and the periods they cover, and help you request the reports from the operator under its terms. See the datacenter → See how we align clients to compliance →
The agreements we’ll sign
Trust should be contractual, not verbal. As part of onboarding we routinely execute:
| Document | When |
|---|---|
| Business Associate Agreement (BAA) | When we manage systems that handle your protected health information |
| Mutual NDA | On request, before or during evaluation |
| Security addendum / questionnaire | When your procurement or insurer requires it — we’ll complete it |
| Security incident notice | By phone and email without unreasonable delay after discovery, and in any case within 72 hours, or 24 hours on Secure IT and for defense contractors and Fannie Mae / Freddie Mac sellers. A shorter period can be set in your service order. |
| Vendors that handle client data | The list is yours on request, and we tell you 15 days before we add one |
| Service agreement | One-year initial term, then month-to-month with 60 days’ notice and no fee to leave. Leaving during the initial term costs half of the remaining months’ fees. There is never an offboarding fee. |
Why we keep some things quiet — on purpose
We don’t publish our client list, the exact location of the datacenter, or the specific security tools we run. That isn’t evasiveness — it’s a control. A public map of who we protect, where their data sits, and which products guard it is precisely the reconnaissance an attacker wants. We share all of it with you, in detail, under NDA. The quiet is part of the protection.
Four decades of verifiable history back it up — our 1980s–90s catalogs and press coverage are on the record. See the receipts →
What happens when your engineer isn’t available
It is a fair question to ask a small team, and it deserves a specific answer rather than reassurance.
You get a named lead engineer
A named lead engineer is assigned to your business and knows your environment. We tell you who it is, and tell you when that changes. You are not explaining your environment to a stranger each time.
And a named backup behind them
Every account has a named lead engineer, and your environment is documented, so it never depends on one person’s memory.
Documented, not memorized
Everything about your environment is documented in our systems, so whoever picks up your ticket starts from the full picture, not from a message. You can have a copy of that documentation within 10 business days of asking. That is the main reason a compact team can carry the load a larger one needs headcount for.
Someone is always on call
Outside business hours our support team responds to calls, texts, email and portal requests to a 60-minute response standard, and our on-call engineer is paged for critical alerts. On Secure IT our security operations partner also holds the continuous watch, working to detection rules and runbooks we write with them and escalating to us.
Your environment is documented in our systems rather than carried in one person’s head, and that documentation is yours to take at any time — see switching. If continuity is the question that decides this for you, ask it on the assessment call and ask our references about it too.
FAQ
Will you sign a BAA, NDA, or security addendum?
Yes. We sign a Business Associate Agreement when we handle protected health information, and we sign NDAs. Security terms you need from us are written into your service order as special terms, so they sit inside the agreement rather than beside it. If your procurement process has a security questionnaire, we’ll complete it.
Where is your datacenter, and why won’t you name the exact location or your tools?
On infrastructure we own inside a carrier-neutral Southern California facility of concurrently maintainable design. Its operator holds SOC 1 & SOC 2 Type II attestations and ISO 27001 and PCI DSS certifications — those are the operator’s credentials, not CRC Cloud’s. We keep the precise location and our specific toolset confidential on purpose — publishing them would hand attackers a map. That discretion protects our clients, not us.
Do you carry insurance?
Yes — professional liability (errors and omissions) and cyber liability. Certificates of insurance are available on request.
Can we get references or talk to a current client?
Yes — privately, with clients who’ve agreed to take reference calls, as part of a serious evaluation. We publish role and industry only, never a public client roster, for the same security reason we keep our stack confidential.
