Kretio LogoKretio
Platform Security

Security Statement

Last updated: September 16, 2026

Security is fundamental to how Kretio is designed and operated. We combine modern cloud architecture, strict data isolation policies, sandboxed crawling boundaries, and encrypted communication to protect your account and website data.

AES-256 & TLS 1.3

Complete data encryption in transit via TLS 1.3 and at rest using industry-standard AES-256.

Strict Tenant Isolation

Database-level row security policies prevent unauthorized access across user accounts.

Sandboxed Scanning

Automated URL crawlers execute in isolated worker nodes separated from database core.

1. Data Encryption & Storage

All data moving through Kretio is protected with modern cryptographic controls:

  • Encryption in Transit: Web traffic and backend API communication use TLS 1.3 encryption by default. Unencrypted HTTP traffic is automatically redirected to secure HTTPS.
  • Encryption at Rest: Database tables, project history, audit metadata, and credentials are encrypted at rest using AES-256 encryption keys.
  • Password & Auth Safety: Passwords are never stored in plain text. Authentication relies on secure salted key derivation algorithms managed by specialized identity infrastructure.

2. Tenant Isolation & Access Control

We enforce multi-tenant isolation at the database layer:

Database Row-Level Security: Every query executed by a user request must satisfy explicit row-level permission policies matching their authenticated ID.
Server-Side Secret Key Isolation: Database administration keys, crawling API credentials, payment secret tokens, and AI API keys are stored exclusively in secure server environments and never exposed to the client browser.

3. Crawling Safety & SSRF Defenses

Auditing user-submitted URLs requires executing network requests. We enforce strict perimeter security for web crawling:

  • Execution Boundary: All website scanning occurs on dedicated worker nodes isolated from internal application services and database servers.
  • URL Scheme Restrictions: Crawlers accept only standard `http://` and `https://` web protocols. Non-web schemes (such as `file://`, `gopher://`, or internal network addresses) are automatically rejected.
  • SSRF & Internal Network Defense: Scans cannot target local loopback addresses, internal network ranges, or private IP spaces.

4. Content Sanitization & AI Safety

Crawled website HTML and text are treated as untrusted external input:

XSS Prevention: Extracted webpage text is sanitized prior to rendering in the UI. Raw crawled HTML scripts are stripped and never executed directly inside the user dashboard.
Prompt Injection Protection: AI language recommendation engines receive structured, factual audit outputs rather than raw unparsed webpage text, preventing prompt hijacking or injection attacks.

5. Payment Gateway Security

Payment processing is fully delegated to PCI-DSS Level 1 certified payment partners. Kretio servers do not collect, process, or store raw credit card numbers or sensitive CVV security codes.

6. Vulnerability Reporting

We value security feedback from the developer and security research community. If you discover a potential vulnerability in Kretio, please report it to us responsibly:

Security Contact

Email security reports with details and reproduction steps to security@kretio.com. We review reports promptly and work to address confirmed issues quickly.

← Back to Kretio Home
Privacy PolicyTerms of Service