Trust
Security and data handling
This page summarises what our Privacy Policy and Data Processing Terms already say. Where this page and those documents differ, the documents apply.
Where your data is processed
The application, database and scanners run in Germany; scan evidence and firmware are stored with Cloudflare, and AI requests go to providers outside the EU.
Workspace records are stored in a PostgreSQL database that KROMSE runs on Hetzner servers in Germany. Each record carries the identifier of its organization and reads are filtered by it. Source code is not sent to an AI provider by default.
Using Hetzner does not make KROMSE an EU-only service: several providers below process data outside the EEA.
Who processes it
The sub-processors KROMSE uses for the platform, as listed in the Data Processing Terms:
- Hetzner: Hosting in Germany of the web application, API, scanner workers and PostgreSQL database, with encrypted database backups.
- Cloudflare R2: Scan evidence and uploaded firmware, through the EU jurisdiction endpoint with automatic region selection.
- Clerk: Authentication, sessions, workspace membership and invitation emails.
- Stripe: Subscription billing and payments through Stripe's hosted pages. KROMSE holds no card numbers.
- Google Workspace: Application email, including contact-form enquiries and operational notifications.
- OpenAI: The AI provider for every AI feature that sends your content.
- Anthropic (United States): Named as an AI provider. No KROMSE feature sends it your content today.
- Mistral AI: Named as an AI provider, with its EU endpoint configured. No KROMSE feature sends it your content today.
- GitHub, other Git hosts and container registries: The sources of the repositories and images you select, accessed on your authorization.
Planned provider changes are reviewed by Kromse Labs S.L. and communicated manually to verified workspace contacts. Questions or objections go to info@kromse.com.
How long scan evidence is kept
Each scan evidence object is given an expiry when it is written, derived from your plan's retention period. Retention periods currently range from 7 days on the free tier and 90 days for beta workspaces up to multi-year periods on higher plans. A periodic job deletes expired objects; findings, reports, audit records and database backups are not erased by that job.
Uploaded firmware stays stored while its product input is active; archiving the input starts its plan-based retention period. The temporary working copy of a repository is removed by normal scan cleanup.
Security and how to reach us
KROMSE has no SOC 2 report, no ISO 27001 certification, and has not had a third-party penetration test. The Privacy Policy describes what is implemented today, without embellishment.
To report a suspected incident, or to ask about data return, correction or closure, write to info@kromse.com, naming the affected workspace and what you observed, without sending passwords or unnecessary personal data.