Crystalknows Inc

Crystalknows Inc publishes a penetration test summary on its trust center. You can request access to it through SOC2C.

Security isn't a single yes/no, but Crystalknows Inc is SOC 2 Type II compliant, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Crystalknows Inc hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@crystalknows.com or via a /security page (Crystalknows Inc lists a security contact).

Crystalknows Inc's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

Crystalknows Inc's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Crystalknows Inc's trust center is at https://trust.crystalknows.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

https://www.crystalknows.com/how-predictions-work Crystal uses a predictive model to predict someone's DISC type, based on publicly available information like job titles, skills, interests, bio/summaries, companies, etc. Our predictive model is trained on large set of anonymized DISC assessment data, allowing us to make a statistically-informed "best guess" about a person's DISC type when they have not taken an assessment. Crystal's predictions are primarily generated from our Chrome Extension, using data strictly in the front end web browser. We also use several fully compliant back end services to aggregate more data points and analyze them for a more accurate DISC profile.

Crystal analyzes publicly available data such as Name, Job Title, Skills, Industries, Interests, Companies (employers), Bio/summary text. If necessary, Crystal will save the following data points: Name, Company (for identification), LinkedIn URL (for caching/performance), Predicted DISC type (analyzed results). https://www.crystalknows.com/privacy

For subscribers, in their personal settings, users can choose to make their results public, private or delete them altogether. For analyzed individuals, it’s important to note that Crystal is only processing data provided by the user or on public web pages. When a Crystal user generates a predicted profile (for an analyzed person), that user has complete control over the profile, including the ability to fully delete it from Crystal’s database in order to comply with any opt-outs, requests, or other internal policies.

Yes, Crystal is and has been compliant with GDPR since the law went into effect. https://www.crystalknows.com/gdpr As a user or data subject, you may request that we confirm whether or not we are processing your Personal Data, and you may request access at any time to your Personal Data over which we have control. You may also request information about our processing of Personal Data, including the type of Personal Data processed and the reasons for such processing. You may request that we change, alter, amend, or update your Personal Data and you may request that we refrain from processing certain information if it is inaccurate or unlawfully held. You may request a copy of your Personal Data for transfer to another entity. You may also, at any time, request that we delete or erase your Personal Data, unless we are required by applicable law to retain such information or have other legitimate grounds for continuing to process your Personal Data. You may also object at any time to our use of your Personal Data to provide direct marketing.

We do! you can find it at: https://www.crystalknows.com/dpa