Trust & Security
Security at Cronxi
Your time, clients, and invoices are sensitive. Here is a plain, honest account of how Cronxi keeps that data safe — no jargon, no certifications we haven't earned, just how the system is actually built.
01Encryption in transit and at rest
Every connection to Cronxi runs over HTTPS/TLS. Traffic between your browser and our servers is encrypted in transit, so your data can't be read on the wire.
At rest, your data lives in Google Cloud managed services — Firestore for your records and Cloud Storage for uploaded files such as receipts and logos. Both encrypt stored data by default using Google Cloud's standard server-side encryption. You don't have to configure anything; it is on for every account.
02Sign in with Google — we never see your password
Cronxi authenticates you with Google OAuth 2.0 through Firebase Authentication. You sign in with your existing Google account, and Google verifies your identity.
Because of this, Cronxi never sees, handles, or stores a password of yours. There is no Cronxi password to leak, reuse, or guess — your account is protected by the security you already have on your Google account, including whatever two-factor authentication you have enabled there.
03Infrastructure and per-user data isolation
Cronxi runs entirely on Google Cloud: the application is served from Google Cloud Run, and your data is stored in Firebase (Firestore, Cloud Storage, and Realtime Database). We build on the same infrastructure Google uses to run its own products.
Every record you create — time entries, projects, clients, invoices, expenses, tasks — is scoped to your own account. Access is enforced on the serverby Firestore security rules, so a request can only ever read or write data that belongs to the signed-in user. One user cannot reach another user's data, and the rule layer fails closed: if a request isn't clearly authorized, it is denied.
- All data is stored under your authenticated account scope.
- Authorization is checked at the data layer, not just in the interface — the client is never trusted as the boundary.
- API routes that access account data verify a Firebase identity token before returning anything.
04Your data is yours
You can take your data with you at any time. Cronxi has built-in PDF and CSV export for your time entries, invoices, and reports — on every plan, including the free tier. Nothing is locked in and nothing is held hostage if you decide to leave.
You can also request full deletion of your account and its data by emailing support@cronxi.com. For the full detail on what we collect, how long we keep it, and the rights you have over it, see our Privacy Policy.
05Payments never touch our servers
If you subscribe to a paid plan, checkout is handled by Lemon Squeezy, our payment provider and merchant of record. Lemon Squeezy hosts the checkout and billing portal and collects your card details directly.
Your full card number and banking credentials are entered on Lemon Squeezy's hosted pages — they never pass through or get stored on Cronxi's servers. We only store your subscription status (such as your plan and billing cycle) so we know which features to unlock for your account.
06Being honest about scope
Cronxi is an independent product, not an enterprise vendor. We don't claim compliance certifications we haven't undergone — you won't find SOC 2, ISO 27001, or HIPAA badges on this page, because making that claim without a completed audit would be dishonest.
What we can tell you is exactly how the system is built, which is what this page does. No method of storing or transmitting data over the internet is ever perfectly secure, but we use the managed, encrypted, access-controlled infrastructure described above, and we fix security issues as we find them or as they are reported to us.
07Report a concern
If you believe you've found a security issue, or you have a question about how your data is handled, please reach out at support@cronxi.com. We take reports seriously and will respond as quickly as we can.