Security and your data
You are trusting Crestyn with your business records, so here is exactly how that works.
Who is behind it
Crestyn is built and run by Mick Lutton, a support worker in Mandurah WA, who invoices plan managers with it too. More on the About page.
Where your data lives
All app data is stored in Australia, in Supabase's Sydney region. It does not leave the country for processing or backup.
Your bank details
Crestyn stores your own bank details for one purpose: printing them on your invoices so plan managers can pay you. They are encrypted at the application layer before they touch the database. No client money ever moves through Crestyn - we are not a payment platform and never hold funds.
Participant information
Invoices carry the minimum participant details an NDIS invoice needs. Access to your records is locked to your account at the database level (row level security), not just in the app code.
Signing in
Lock your login down further any time - turn on a code from an authenticator app, or a one-time code by email, in a couple of taps from your account settings.
Export any time, no exceptions
Your whole account - invoices, clients, everything - exports as a single zip file whenever you want it, even on a trial account. If you do not subscribe after your trial period ends, you are not locked out - you keep read-only access and can still export everything, free. If you never subscribe, the account is deleted 120 days after your trial ends (we email you well before that happens, and you can extend the date in the app). If you cancel a paid subscription, export what you need before you go. Full detail in the Terms of Service.
This website
This site sets no advertising trackers and shows no popups. Analytics, when enabled, are cookieless and aggregate only. The site serves over HTTPS with strict security headers.
Read enough? Start your free 30 days - no card required.
Found a security issue? Email security@crestyn.au and it will be looked at fast.