Trust and compliance

    Security and data protection

    Krak Stack is built for European mid-market operators who care about their data, their compliance obligations, and their customer trust. Here's how we protect them, and what we don't promise that we can't deliver yet.

    Hosted in the European Union

    The Krak Stack application and its database run on a dedicated server in Germany, in the European Union, behind Cloudflare, which filters traffic and encrypts every connection. Krak Stack is operated by EEvolve Me SA, a Swiss company.

    Service providers that handle part of the data:

    • Hostinger: server hosting (Germany)
    • Cloudflare: network protection, encrypted connections and the encrypted off-site backup copy
    • Resend: sending of emails (Ireland)
    • Stripe: subscription card payments. Krak Stack never stores card numbers.

    Each company sees only its own data

    Every container, contract, invoice and document belongs to one company workspace. Only users invited to that workspace can see it, and every query of the application is scoped to the workspace of the user.

    A second lock at the database level is being rolled out: PostgreSQL row-level security policies on every table that holds company data, so the database itself refuses rows of another company. An automated test checks that no company table is missing its policy.

    Access and sign-in

    • Roles and permissions: predefined roles (Admin, Sales, Operation, Finance), adjustable per module: view, manage and see amounts. Sensitive actions such as permanent deletion are separate rights.
    • Two-step sign-in: a one-time code sent by email on top of the password.
    • Encrypted connections: HTTPS everywhere. Bank and email provider keys are stored encrypted in the database.
    • Private files: photos, attachments and uploaded documents are only served to signed-in users of the workspace.
    • Read-only banking: the bank connection reads accounts and transactions. It never makes payments.

    History of changes

    Records keep a history of their changes: who did what and when, for container status changes, deals, invoices and documents. The dashboard shows the latest activities with the name of the user. Most deleted items go to a trash first and can be restored.

    Backups

    • Nightly backup of the full database, kept 14 days on the server.
    • Encrypted off-site copy of each nightly backup, kept 60 days outside the main server (Cloudflare R2). Its size is checked after each transfer and an alert is sent if a backup is missing.

    Your data stays yours

    • Full export on request: a ZIP file with all your company data (one CSV file per table) and your uploaded documents
    • CSV or XLSX export of the lists, depending on user rights
    • Data Processing Agreement (DPA) available on request
    • List of service providers available on request

    For specific compliance questions or DPA requests, contact info@krak-stack.com.

    Responsible disclosure

    If you discover a security vulnerability in Krak Stack, please report it to info@krak-stack.com. We acknowledge reports within 2 business days and work directly with researchers on remediation.

    What we do not claim

    Krak Stack holds no security certification today (SOC 2, ISO 27001) and has not yet published a penetration test report. If your procurement process requires them, we answer security questionnaires and walk your IT team through the architecture.

    Questions?

    Need a security review or DPA?

    We respond to security questionnaires and DPA requests directly. Get in touch and we'll set up a call with the right person.

    Start 14-day free trial