Security
Cruma handles inboxes, files, customers, and money. Here is how that is protected, in plain terms.
Independent audit, in preparation
The controls on this page are not a roadmap; they run in production today. A SOC 2 Type 1 audit to verify them independently is in preparation. For current status, or the report when it lands, write to hello@cruma.ai.
Sign-in without passwords
Google, Microsoft, or a one-time email link. Two-step verification on every account, required for our own operations access.
Your workspace is a wall
Every request is checked against who is asking and what they may see. The database adds an independent deny-by-default layer, and automated tests prove the isolation holds on every change.
Approval before anything consequential
Actions that reach the outside world wait for your explicit approval, and every one leaves a permanent, tamper-evident record. Nobody can quietly edit or delete the history.
Encrypted in transit and at rest
TLS on the wire, encrypted storage underneath, and an extra AES-256 layer on browser session data with a key that never leaves the server.
Changes ship through a gate
Secret scanning, automated dependency updates, isolation tests, and the full test suite run on every change. No green, no ship.
Your data is not the product
Training on your run history is opt-in only, off by default, and enforced fail-closed. Every provider that touches customer data is listed publicly.
Check for yourself
- Live status independently hosted uptime, incident history included
- Subprocessor list every provider customer data reaches, and why
- Privacy Policy what is collected and the opt-in-only training rule
- Data Processing Addendum processing terms for business customers
- security.txt RFC 9116 disclosure contact, machine-readable
Our security policies are written in plain markdown and version-controlled alongside the code they govern, so a policy change leaves the same audit trail as a code change. Available to customers and auditors on request.
Found a vulnerability? Tell us at hello@cruma.ai. We respond quickly, take it seriously, and never pursue good-faith research.