Security
Stated plainly. Current status only. No overclaims.
Costing and pricing data is some of the most sensitive commercial information a firm holds. Craftsheart's security posture reflects that. This page states what we do, what we're currently working on, and what we haven't yet completed - as of today.
01 - data handling
What is stored, and for how long
- Project files ingested through connections are indexed and stored in encrypted form, in the region closest to your billing entity.
- Cost and pricing extracts derived from those files are stored alongside the project metadata that produced them.
- Retention is scoped to your organisation's tenure on the platform. On termination, source files and derived extracts are purged within 30 days of the final invoice.
- You can request an on-demand export of everything stored in your workspace at any time - the export is delivered in a machine-readable archive.
02 - encryption
Encryption in transit and at rest
- All traffic between your browser, the platform, and any connected data source runs over TLS 1.2 or higher.
- Data at rest is encrypted using AES-256 - both the primary object store and the derived indices are covered.
- Encryption keys are managed by our infrastructure provider's managed KMS. Keys are rotated on a fixed schedule and can be revoked on request for termination.
03 - access
Role-based access, scoped by responsibility
- Every workspace user is scoped to one of three role bands: estimator, sales, or finance. Each has a distinct view of what is exposed - line-item cost, only totals, or full financial detail.
- Access grants are auditable. Every change to a role - and every access to a sensitive record - is logged.
- Optional single sign-on integration is available on Growth and above, using SAML 2.0 or OIDC.
04 - posture
Compliance posture, stated honestly
- Craftsheart is a young platform. We do not overclaim on compliance certifications we have not completed.
- Currently underway: infrastructure controls aligned to ISO/IEC 27001 practices. Documentation is available on request under NDA.
- For clients under specific regulatory frameworks - healthcare, government, defence - we will not commit to compliance we have not achieved. We will show current status, roadmap, and dates.
reporting a security concern
Something looks off? We want to know before anyone else does.
Reach the security team directly through the contact page. We triage every report within one business day, and we do not penalise honest disclosure - responsibly reported issues are acknowledged, tracked, and closed out with the reporter.