generated: '2026-08-12'
method: searched
source: https://www.joincrowdhealth.com/data-security
disclosure:
  published: true
  page: https://www.joincrowdhealth.com/data-security
  security_contact: security@joincrowdhealth.com
  security_txt: false
  security_txt_note: >-
    No RFC 9116 /.well-known/security.txt is served on any CrowdHealth host (all probes
    404). The security contact is published only as an email address in prose on the
    data-security page, so a machine cannot discover it.
  bug_bounty:
    program: null
    platform: null
    note: >-
      No bug bounty or coordinated vulnerability disclosure program (HackerOne, Bugcrowd,
      Intigriti) was found for CrowdHealth.
  safe_harbor: false
  policy_url: null
assurance:
  third_party_pentest:
    published: true
    vendor: Astra Security
    cadence: annual
    statement: >-
      "Every year, CrowdHealth undergoes rigorous third-party security penetration
      testing."
    certificates:
    - scope: AWS
      url: https://cdn.prod.website-files.com/60db2ced4a27795173580197/6809561c34e3753510499bf4_AWS_Astra_Pentest_Certificate.pdf
    - scope: iOS
      url: https://cdn.prod.website-files.com/60db2ced4a27795173580197/6809561e7d297d134fa3e529_iOS_Astra_Pentest_Certificate.pdf
    - scope: Android
      url: https://cdn.prod.website-files.com/60db2ced4a27795173580197/68095620b08d4b8831c421d3_Android_Astra_Pentest_Certificate.pdf
  encryption:
    at_rest: true
    in_transit: true
    statement: >-
      "All your data is encrypted both when it's stored ('at rest') and when it's being
      sent between systems ('in transit')."
  access_control: least-privilege (stated)
gaps:
- No /.well-known/security.txt — the security contact is not machine-discoverable.
- No published disclosure policy, safe-harbor statement, or response-time commitment.
- No bug bounty or VDP platform listing.
x-evidence:
- url: https://www.joincrowdhealth.com/data-security
  http_status: 200
  fetched: '2026-08-12'
- url: https://www.joincrowdhealth.com/.well-known/security.txt
  http_status: 404
  fetched: '2026-08-12'