A simple guide to security at Kraaft

☁️ Where is customer data hosted?

• We use the NoSQL Firestore database, which has the advantage of being designed for mobile, real-time, and offline use. Firestore stores certain data in the phone's cache to provide an "offline" data browsing experience.
• We use three storage components: Firebase Authentication, Firestore (real-time database), and Google Cloud Storage (files).
• Data is stored on GCP (Google Cloud Platform) in a multi-tenant environment: St Ghislain (Belgium) and Eemshaven (Netherlands). Google manages data replication and ensures very high availability.
• All data is encrypted at rest using the algorithm AES-256, whether in the database (Firestore) or for stored files (Google Cloud Storage).
• The physical and organizational security measures implemented by Google Cloud are documented in its SOC 2 reports: https://cloud.google.com/security/compliance/soc-2?hl=en
• KRAAFT architecture and data hosting diagram

📀 How can you retrieve your data at any time?

• Data is automatically backed up daily with a 30-day retention period, which allows for restoring the previous day's data in case of an issue. Furthermore, Kraaft does not charge for storage! That is why we encourage you to keep your data with us: it is simple, at no extra cost, and secure. However, if you prefer to keep your own backups, there are four ways to retrieve your data:
  • Option 1: On a daily basis, any user can export data from a specific project, including (i) photos, (ii) chat history, (iii) shared documents, and (iv) all completed reports. Export formats: Word, PDF, or Excel file, or a .zip folder containing the photos and documents. In short, when you finish a project, you can press a button and retrieve the entire folder to store it on your computer.
  • Option 2: If the manual archiving described in Option 1 seems tedious, you can also securely connect Kraaft to SharePoint / OneDrive. Once the connection is established, there is nothing more to do! All your Kraaft data (photos, videos, documents, and reports) will be automatically copied and stored in your SharePoint. More information here.
  • Option 3: To automate the retrieval or synchronization of certain structured data, you can use Kraaft Public API. In particular, it allows you to view schemas, records, and their modification history in authorized workspaces. Access requires authentication via OAuth or an API key and respects the permissions defined in Kraaft.
  • Option 4: Imagine you cancel your Kraaft subscription and want to retrieve all your data at once. For this situation, we have established a data reversibility procedure: "at the Client's request, Kraaft can retrieve and share a JSON file containing all Client Data in its possession." This means we will send you a very large file that won't be easy for a non-specialist to read, but your IT department will be able to process it without any trouble! :-)
• The request procedure is described in Article 7, "Reversibility," of the General Terms and Conditions; we commit to acknowledging receipt of the request by email within 48 hours (2 business days) and to finalizing the process within an additional 15 business days.www.kraaft.com/cgv); we commit to acknowledging receipt of the request by email within 48 hours (2 business days) and to completing the process within an additional 15 business days.
• Our Disaster Recovery Plan (DRP) is tested annually.

Identity and Access Management (IAM)

• Every connection to the Kraaft application is encrypted in transit using TLS 1.2/1.3, ensuring the confidentiality and integrity of all web requests and guaranteeing that all information is transmitted securely to our servers.
• All access to the Kraaft application (except for login and registration pages) is secured by authentication (email/password, phone, or SSO), and every request made by the application to our servers is secured using authentication tokens.
• The client must inform their end users that their personal data is processed by Kraaft. The Kraaft privacy policy applicable to this processing is available here:https://www.kraaft.com/confidentialite
• Our platform offers Role-Based Access Control (RBAC) features. This system allows for a separation of duties based on precise access control within an organization. See the role details below: https://help.eu.kraaft.co/fr/articles/236722-les-roles-qui-peut-faire-quoi
• Unique and personal identifiers: Each user of the Kraaft platform is assigned a unique and personal identifier (based on their email or phone number). Shared accounts are prohibited to ensure clear traceability and accountability for every action performed on the platform.

Accessibility Guarantees (SLAs)

• We do our best to ensure the Solution is accessible 24/7, except during periods of preventive and corrective maintenance. Our hosting provider, GCP, guarantees very high availability.
• Whenever  possible, we provide 48 hours' notice for maintenance and service interruptions.
• Outside of preventive maintenance periods, Kraaft guarantees the following Service Level Agreements (SLAs): an RTO (Recovery Time Objective), or maximum recovery time, of 48 hours, and an RPO (Recovery Point Objective), or maximum data loss, of 24 hours.
• Our internal processes help limit production bugs despite monthly updates:
  1. Developers participate in select product workshops and do not discover user stories (US) at the last minute; they prepare technical specifications that are reviewed and approved by multiple people;
  2. Unit tests are implemented for almost all new components, while end-to-end (E2E) tests cover critical paths.
  3. Quality assurance (QA) is performed for every feature and application update.
  4. A "release procedure" is created for each version, summarizing all the instructions required for a smooth deployment (such as migration scripts and adding or modifying environment variables);
  5. Continuous integration (CI) and continuous delivery (CD) workflows automate deployments to the web and app stores.
• We have implemented an error log monitoring dashboard.
• We automatically monitor our infrastructure to detect security issues and apply necessary patches.
• We protect our web applications by filtering malicious traffic based on IP addresses, HTTP headers, HTTP bodies, or URI strings, thereby blocking common attacks such as SQL injection and cross-site scripting. We have also implemented measures to protect against DDoS and MITM attacks through highly available load balancers and a robust SSL/TLS infrastructure.

🧠 Data ownership and usage

• All data provided to Kraaft by the client belongs to the client ("Client Data"). Job site photos shared on Kraaft cannot be used by our teams for commercial purposes. This may seem obvious, but it is worth repeating!
• The Client grants Kraaft the right to access and use Client Data as necessary to fulfill its obligations, for example, so that your Customer Success Manager can assist you in the event of an issue.
• Kraaft continuously improves its solution, notably through client feedback and aggregated or anonymized usage and analytics data. Kraaft remains the owner of the solution as well as the integrated features, modules, and developments. This ownership never extends to client data, which remains the property of the client. For example, if you share utility marking photos in Kraaft and we develop a utility detection reporting module, you retain ownership of your photos, while Kraaft retains ownership of the module it developed.
• Our privacy team will be happy to answer any questions or requests you may have. You can contact them at dpo@kraaft.co.

🇪🇺 GDPR

• Kraaft commits to processing all information made available to it in the course of its activities in accordance with applicable regulations [personal data protection requirements (French Law No. 78-17 of January 6, 1978, as amended), as well as Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC], and with specific agreements concluded with its clients.
• Kraaft affirms that its services have been developed in accordance with the principles of "Privacy by Design" and "Privacy by Default," thereby including features that allow the client to meet their obligations as a data controller.
• Kraaft commits to using the client's personal data only within the scope of using its services and solely according to the client's documented instructions.
• In accordance with its obligations under Article 28 of the GDPR, Kraaft commits to notifying the Client, without undue delay after becoming aware of it, of any personal data breach likely to affect the Client's personal data.
• The processor declares that all internal or external personnel likely to process the client's personal data are bound by a confidentiality agreement, an information systems policy, or another legally binding instrument, and receive regular training and awareness sessions.

Report a vulnerability

We welcome reports from security researchers. Any research conducted in good faith and in compliance with our policy will not result in legal action. To learn more about the scope, rules, and reporting procedure, please consult our Vulnerability Disclosure Policy, or email us directly at security@kraaft.co.

🔐 ISO 27001 Certification

• Kraaft has been ISO/IEC 27001:2022 certified since May 2025, demonstrating our commitment to information security best practices. This international certification validates the robustness of our Information Security Management System (ISMS).
• The scope of the certification covers the technical infrastructure, applications, and systems used to provide our cloud product services to customers, as well as all technical activities that hold, obtain, share, or manage customer and company data, and the following business functions: HR, Engineering, Product Management, Customer Support, Sales & Marketing, and Finance.
• Our certification is issued by INTERCERT (registration number: IC-IS2505209) and can be verified on their official portal: https://www.intercert.com/resources/certification-verification

• This certification is subject to annual surveillance audits and recertification every three years, ensuring our security standards are continuously maintained at the highest level.

👔 How do we mitigate risks related to human factors?

• Two security contacts have been designated at Kraaft: Régis SENET (regis.senet@kraaft.co), the company's CISO, and Cédric BOIDIN (cedric@kraaft.co), Chief Technology Officer and point of contact for implementing new solutions or technical documentation.
• Kraaft has implemented a phishing awareness program using the Bastion software (https://app.bastion.tech/). As a reminder, according to ANSSI, phishing is the primary vector for cyberattacks, and human vulnerability is the easiest way to compromise an organization. The platform allows us to train and test our teams through phishing simulations.
• Suspicious emails are shared daily in a Microsoft Teams channel titled "Phishing."
• Every week, Marc NÈGRE presents a security-related topic—a piece of knowledge or a best practice—during the all-hands meeting, drawing on the key categories provided by ANSSI.
• Kraaft has printed and posted security best practices on its office walls.
• All employees use the DASHLANE password manager (https://www.dashlane.com/) to manage their professional credentials, using complex, randomly generated passwords.
• The source code is hosted on GitLab via their standard professional plan, with multi-factor authentication enabled.
• Article 11 of our employment contracts sets out a series of professional obligations applicable to all employees, including duties of exclusivity, loyalty, confidentiality, and the return of documents.

🧱 What technologies are used in the application?

• TypeScript
• Frontend: React and React Native in a monorepo (with some shared components and logic).
• Backend: Node.js, using a Domain-Driven Design (DDD) architecture to clearly separate the infrastructure layer (database and service providers) from our core business logic.

🤖 Do you have an API?

• Kraaft offers a public REST API for connecting third-party applications and automating data exchange with Kraaft.
• The API allows you to view and modify records, access schemas and change events, manage certain conversation properties, and post messages or files.
• Every request must be authenticated. Two methods are available:‍
  • ‍OAuth, for applications acting on behalf of a user. The application can only access data that the user is authorized to access;‍
  • API Key, for automation and server-to-server communications.
• Permissions applied by the API respect the memberships and roles defined in Kraaft. Private conversations remain accessible only to their members.
• Technical documentation is available at developers.kraaft.co.

🔐 This document was updated on August 24, 2026