nCrypt / CrossBorder / Security
Pilot 0
Security and data handling
Plain statements about how CrossBorder is built and what it stores. This page describes the Pilot 0 application. It makes no claim of certification or independent audit.
Sign-in and accounts
CrossBorder runs on its own application address, crossborder.ncrypt.nz, separate from this marketing site. Sign-in uses an OpenID Connect identity provider through the nCrypt Foundations platform, so CrossBorder does not handle your password. After signing in you create or join an organisation. Roles within an organisation control who can read, write and archive.
Organisation isolation
Every request is checked against your organisation membership and role before data is read or changed. Records belong to one organisation, and identifiers from another organisation are not accepted. State-changing requests require CSRF protection. Actions are recorded as audit events.
Deterministic evaluation
A stay is checked by deterministic code against represented rules. The same inputs give the same result, and no AI makes or alters the decision. A check never changes your plan.
Regulatory provenance and history
Rules are entered by nCrypt with a supporting source and are versioned. Each result records the rules and versions it used, so an earlier result stays explainable. Evaluation history, published rule versions and alerts are protected against editing by database triggers. Monitoring re-evaluates affected stays when a represented rule changes and keeps the earlier result.
Coverage is operator-maintained and not comprehensive. CrossBorder is not endorsed by or affiliated with any government or immigration authority.
What CrossBorder stores
- Traveller display name and notes.
- Passport issuing country, label, dates and notes. No passport number and no scan.
- Permission dates and label, and work classification, country and notes.
- Travel history, plans, stays and notes.
- Document metadata only: category, label and dates. No uploaded files.
- Budget labels and amounts, and your user identity and audit events.
CrossBorder does not store passport or document numbers, uploads, bank or card details, search history from “Where can I go next?”, AI prompts or credentials. Free-text notes are your responsibility: please do not enter numbers or other sensitive identifiers.
Logging and tracking
The application includes no analytics or trackers. Operational logs use an allowlist of fields such as request id, route, status and duration. They do not contain passport data, tokens, document text or budget notes.
What we do not claim
- No security certification, formal audit or penetration-test claim.
- No uptime guarantee or service-level agreement.
- User data export and account deletion are not yet self-service in Pilot 0. Contact [email protected] for data requests.
- Alerts are in-app only.
CrossBorder is operated by NCRYPT LIMITED in New Zealand. Report a security concern to [email protected]. See also how CrossBorder works and the nCrypt home page.
Ready to try the Pilot?
Sign in, create an organisation and add your first traveller.
Start planning Back to CrossBorder