Security at Kroveo
Your reports describe how your business runs. Here is how we keep them, and the data behind them, separate, encrypted and under your control.
-
Organisations are isolated
Every record and file belongs to one organisation, and your organisation is taken from your sign-in, never from the request. Automated tests try to reach another organisation’s reports, models and files on every change and must be refused.
-
Encrypted in transit and at rest
All traffic uses TLS. Uploaded files and generated reports are stored with AES-256 encryption. Downloads use short-lived signed links.
-
Sign-in you already trust
Sign in with Microsoft Entra ID or Google. We never store passwords, and your multi-factor and conditional access rules apply as usual. Admins can let everyone on the company domain join automatically.
-
Your AI key stays sealed
Your OpenAI or Azure OpenAI key is encrypted, opened only for your own requests, and shown to admins as its last four characters. Request bodies are not logged.
-
Publish as yourself
Fabric publishing runs under the signed-in person’s own Microsoft account and Fabric role. Kroveo holds no service account with access to your tenant.
-
Delete means deleted
When you delete a file or model, it is removed from storage and the database, not hidden. Uploads, downloads, shares and deletions are recorded in an audit log admins can review.
Where your data goes
The services Kroveo relies on, and what each one sees.
| Service | Purpose | What it receives | Where |
|---|---|---|---|
| Cloudflare | Hosting, compute, database and file storage | Everything you store in Kroveo, encrypted | [REGION] |
| OpenAI or Azure OpenAI | Reading mockups and revision requests, through your own key | The image or text you submit, plus table and column names. [CONFIRM: no data rows] | Set by your provider account |
| Microsoft | Sign-in (Entra ID) and Fabric publishing | Your sign-in; the report you choose to publish | Your tenant |
| Sign-in | Name, email address, profile picture |
Certifications
Kroveo is built and operated by Deka Technology. Deka’s management system is certified for software development, business intelligence, database management, infrastructure and DevOps, and its software processes are independently assessed for maturity.
-
ISO/IEC 27001:2022
Information security management
- Scope
- How we protect information: access, encryption, incident response, supplier control.
- Certificate no.
- IFC-I-7-24-2217
- Valid until
- 18 July 2027
- Certified by
- IFC Global
-
ISO 22301:2019
Business continuity management
- Scope
- How we keep services running and recover when something goes wrong.
- Certificate no.
- IFC-I-7-24-2217
- Valid until
- 18 July 2027
- Certified by
- IFC Global
-
ISO/IEC 20000-1:2018
IT service management
- Scope
- How we plan, deliver, support and change the services we run.
- Certificate no.
- IFC-I-7-24-2217
- Valid until
- 18 July 2027
- Certified by
- IFC Global
-
ISO/IEC 33061 · SPICE Level 2
Organisational process maturity, staged level 2
- Scope
- An independent SPICE assessment of how we engineer and manage software: 16 engineering and management processes.
- Certificate no.
- ISO/IEC 33061-530
- Valid until
- 13 September 2029
- Certified by
- ICT Certify
ISO/IEC 27001, 22301 and 20000-1: issued by IFC Global, certificate no. IFC-I-7-24-2217, valid until 18 July 2027. ISO/IEC 33061 (SPICE): issued by ICT Certify, certificate no. ISO/IEC 33061-530, valid until 13 September 2029, verifiable at ictcertify.com with code neZ8TNyM. Copies are available on request.
Who runs Kroveo
Kroveo is built and operated by Deka Technology (Deka Teknoloji Bilişim Hiz. ve Tic. A.Ş.), Maltepe, Istanbul, an enterprise IT and data services company.
Security questionnaire or DPA? We are happy to go through it with your team.