Business Continuity Statement

1. Our Commitment

Crewkind Ltd ("Crewkind", company no. 17256941) operates workforce management software that our tenants rely on for day-to-day operations — scheduling, attendance, HR records, and employee engagement. We treat platform continuity as a data-processor obligation under our Data Processing Agreement, not simply a technical best-effort.

This statement sets out the arrangements we have in place to ensure the platform remains available and operationally recoverable — and what tenants can expect from us if something does go wrong.

2. Platform Resilience

The Crewkind platform is built on enterprise-grade infrastructure:

• Hosting: Vercel (EU region) — globally distributed, 99.99% uptime SLA, automatic failover across edge nodes.
• Database: Supabase (eu-west-1, Dublin) — PostgreSQL with automated daily backups and point-in-time recovery capability.
• Email delivery: Resend — redundant delivery infrastructure with SPF/DKIM/DMARC authentication on mail.crewkind.app.
• Source code: GitHub — full version history; the entire platform can be restored from a clean clone within hours.
• DNS: Cloudflare — protected against DDoS, with global anycast routing.

No single piece of hardware or infrastructure controls the live platform. All compute, database, and delivery functions are provided by managed cloud services with independent resilience guarantees.

3. Operational Continuity

We maintain the following operational arrangements to ensure service continuity is not dependent on any single individual or system:

• Technical continuity contact — a designated senior developer with documented emergency access to all platform infrastructure, able to respond to incidents, deploy fixes, and co-ordinate recovery independently.
• Customer continuity contact — a designated person responsible for tenant communications during any operational incident, including acknowledgement, status updates, and service-credit co-ordination.
• Credential vault — all service credentials, API keys, and access tokens are held in a secured vault with documented emergency access. No critical credential exists in a single location.
• Corporate authority — legal instruments are in place to ensure that an authorised person can act for Crewkind Ltd within 24 hours of any operational disruption, without delay from administrative or legal process.

4. Incident Response

Platform outage

• Acknowledgement to affected tenants: within 2 hours of detection during business hours; within 4 hours out-of-hours.
• Status updates: every 2 hours until resolution.
• Resolution target: within 4 hours for infrastructure-level outages; within 24 hours for application-level incidents.
• Post-incident report provided within 5 business days of resolution.

Data incidents

• We notify affected tenants (as data controllers) within 24 hours of confirming a personal data breach — ahead of the 72-hour ICO reporting clock.
• Notification includes: what happened, what data was affected, the likely consequences, and the steps we are taking.
• We provide tenants with the information they need to fulfil their own reporting obligations to affected data subjects.

5. Data Recovery

In the event of data loss or corruption:

• Recovery point objective (RPO): 24 hours — automated daily backups mean a maximum of 24 hours of transactional data could be lost in a worst-case database failure.
• Recovery time objective (RTO): 4 hours from decision to restore — the time from invoking a backup restore to the platform being fully operational.
• Tenant data is held in a single-tenant logical partition (all tables include a tenant_idcolumn with row-level security enforced at the database layer). One tenant's data cannot be accessed by another, including during restore operations.

6. Contacts

7. Review and Testing

This statement is reviewed quarterly. We conduct an annual recovery drill — a timed test of our ability to restore the platform from scratch — and record the outcome in our internal runbook. Results are available to tenants on request.

The full internal business continuity plan, technical runbook, and breach-notification procedures are held in our compliance documentation and are available to enterprise tenants and prospective customers under NDA.