Trust
Security at CRAFT
What protects your data today, what we are still building, and what CRAFT will never do. CRAFT holds no security certification, and this page claims none.
Last updated 22 October 2026
In place
Running in the product today.
Sign-in
In placeSessions use a short-lived access token (one hour) and a refresh token kept in a same-site cookie that page scripts cannot read. Passwords are stored only as bcrypt hashes. Two-factor sign-in with an authenticator app is available to everyone. Sign-in attempts are limited to 5 every 15 minutes from one address.
Encryption in transit
In placeCRAFT is served only over HTTPS. Browsers are told to use HTTPS for every visit (HSTS), and standard security headers are sent with every page.
Connection tokens encrypted at rest
In placeThe tokens that let CRAFT read a connected mailbox, calendar or CRM (Google, Microsoft, Salesforce and the other connectors) are encrypted with AES-256-GCM before they are stored.
Your company's data stays your company's
In placeEvery record belongs to one company, and each feature checks the signed-in person's company before it reads or changes a record. A second, database-level guard is being rolled out (see In progress).
Audit trail
In placeEvery change made through CRAFT is recorded with who made it, when, and which kind of record it touched. Security events are recorded too: sign-ins and failed sign-ins, two-factor changes, password and role changes, exports and deletions. Request contents, email text, passwords and tokens are never written to it. Entries are kept 365 days.
Rate limits
In placeSign-in, the API as a whole and the AI features have request limits, so one account or address cannot flood the service.
Agents draft, people send
In placeCRAFT's agents, the Crafties, write drafts and suggestions. None of them can send an email, post a message, book a meeting or write to your CRM. A test scans every file an agent runs and fails the build if a send, post, booking or CRM-write call appears.
Agent Passport
In placeThe platform, not the agent, keeps a record of each agent run: what it called, which model, and the ids of the records it touched. It stores ids only, never the content. Each entry is chained to the one before it with a SHA-256 hash, so a changed or removed entry shows when managers verify the chain. The record can be exported and kept outside CRAFT.
AI controls per company
In placeAn admin can limit which AI providers and models may receive the company's data. The limit is checked in code before any request is sent, and a disallowed call is refused and recorded. A company's data tier can also keep its data away from the hosted AI service entirely.
Where AI requests go
In placeCRAFT's AI runs on Anthropic's API (Claude). Anthropic's standard commercial API terms apply to what CRAFT sends, including how long Anthropic keeps it. A zero data retention arrangement is not in place.
Desktop app redacts on your laptop
Rolling outWhen you ask the desktop app to look at your screen, it reads the screen on your laptop first and blacks out email addresses, phone numbers, dollar amounts and SSN- and card-like numbers before anything is sent. You see the exact frame that was sent. Screens marked CUI, FOUO or classified are refused, not looked at. This arrives with desktop version 0.4.0, which is rolling out now.
Nightly backups
In placeThe database is copied every night and each copy is kept 30 days. Today the copies are stored on the same server; moving them off it is in progress.
When your company leaves
Our promiseWhen your company stops using CRAFT, we delete its data. Ask us and we will confirm in writing when it is done. Nightly backup copies age out within 30 days.
Hosting
In placeThe application runs on a DigitalOcean server in New York (NYC1). The database is PostgreSQL hosted by Supabase on AWS in US East (Northern Virginia). Both are in the United States.
In progress
Not done yet. We say so plainly and will update this page as each one lands.
Database-level customer separation
Being rolled outA guard that adds your company to every database query, on top of each feature's own check. It is running in watch mode: it logs any query that would cross companies but does not block it yet.
Off-site backups with tested restores
In progressEncrypted copies of the nightly backup stored away from the server they protect, with regular test restores.
Separate development and production databases
In progressDevelopment and testing moving onto their own database, away from customer data.
Credential rotation
In progressRotating service credentials on a schedule and moving secrets into a managed store.
Two-factor required for leaders
Not yetTwo-factor sign-in is available to everyone but not yet required for managers and admins.
Independent penetration test
Not yetWe test CRAFT ourselves. An independent firm has not tested it yet.
SOC 2
Not startedCRAFT has no SOC 2 report and the audit has not started.
Google security assessment for Gmail
Not yetGoogle requires a CASA security assessment for apps that use Gmail's restricted permissions. CRAFT has not completed it.
FedRAMP
Not pursuedCRAFT is not FedRAMP authorized and is not a system for CUI or classified information. Please don't put that information into it.
What CRAFT will never do
Send, post or book for you
No agent can send an email, post a message, book a meeting or change your CRM. Anything that leaves CRAFT waits for a person to click.
Hand an agent your keys
Mailbox and calendar tokens stay encrypted inside CRAFT. An agent never receives one; it can only call the specific CRAFT actions listed for it.
Sell your data
We don't sell your data, and we don't share it with other customers.
Learn from one company for another
The selling patterns CRAFT learns from your deals stay inside your company. They are never used for, or shown to, another customer.
Train AI models on your data
CRAFT has no code that trains or fine-tunes an AI model on customer data, and under Anthropic's commercial terms what CRAFT sends is not used to train their models.
Report a problem
Found a security issue?
Tell us through the Talk to us page and we'll reply in writing. Please include what you found and how to see it.
A dedicated security contact address is coming soon.
Report it