We work inside your accounts
Your cloud, repositories, ticketing and RMM stay in your name. Our engineers log in to your environment; your code and data stay there.
Security and Trust
Your systems stay yours.
Your systems stay yours.
This is how we protect them.
When an MSP, MSSP or product company gives CrewNexa access, these are the rules our engineers work under. Operations follow ISO 27001 practices, and we never claim a certification we do not hold.
Access
How access works
Only the access the task needs
Every proposal lists the exact access required, for the named engineers on your account only. Nothing more is requested.
NDA before credentials
We sign your NDA, or ours, before any credential is shared with the team.
You own what we build
Code, documentation, configuration and data belong to you from the first day of the engagement.
People
Who works on your account
One accountable lead from the first call to delivery, and a team that is screened before it sees anything of yours.
- Contract and confidentiality agreement. Every engineer signs an employment contract and a confidentiality agreement before joining a client account.
- Background and reference checks. Completed before anyone is added to your account.
- In-house delivery. About 95% of our delivery is done by our own team in Lahore. Specialists from a vetted external pool, such as certified penetration testers or ISO auditors, join only for specific project needs.
- One accountable lead. Mudassar Zafar, Founder and CEO, runs every new engagement personally and decides which controls your account needs before anyone else is added.
Workspace
Where the work happens
Office run to ISO 27001 practices
Our Lahore office operates to ISO 27001 practices, with a business continuity plan behind every engagement.
A dedicated room for your team
For white-label and dedicated teams we set up a walled sub-office used only by your team, with your equipment and your firewall and security terms. Ready in 2 to 3 days.
Visibility you can check
For teams of three or more: cameras with a live view of the room, and daily and monthly attendance reports.
Hardware is your asset
Equipment bought for your work belongs to you. At the end of the engagement it is disposed of as you instruct, or we pay you its value.
Your time zone
Our team already works US, UK, EU and Australian hours, so issues are handled in your working day, not ours.
Regulated work
We have delivered HIPAA-ready work inside a client's own Google Cloud project, and we help clients prepare for SOC 2, ISO 27001, HIPAA, PCI DSS and CMMC.
Commercial safety
You pay for delivered work
The commercial model is built so you carry as little risk as possible.
- Written scope first. Deliverables, milestones, timeline and price are agreed in writing before work starts.
- Fixed price per milestone. You release payment only when a milestone is delivered and accepted.
- Daily written updates. On the channel you prefer, aligned to your time zone.
- Your questionnaire, answered. Send us your vendor security questionnaire and we answer it in writing.
Ready to Start Building?
Get a free engineering consultation. No commitment. No pressure. Just answers.