Security and trust at Krea

We maintain an Information Security Program that is communicated throughout the organization. Krea is SOC 2 compliant: an independent audit firm has examined our controls against the SOC 2 framework, a widely recognized information security auditing procedure created by the American Institute of Certified Public Accountants (AICPA). The full report is available under NDA through our Trust Center.

Krea undergoes independent third-party assessments to test our security and compliance controls.

We engage an independent third party to perform penetration testing at least annually to ensure the security posture of our services remains uncompromised.

Roles and responsibilities related to our Information Security Program and the protection of customer data are well defined and documented. Team members are required to review and accept all security policies.

All team members complete security awareness training covering industry-standard practices and information security topics such as phishing and password management.

All team members are required to sign and adhere to an industry-standard confidentiality agreement prior to their first day of work.

We perform background checks on all new team members in accordance with local laws.

Our services are hosted with trusted, industry-leading cloud infrastructure providers, including Amazon Web Services (AWS), each of which operates a robust security program with multiple certifications. For more information on AWS security processes, see https://aws.amazon.com/security/.

Our primary application databases are hosted on managed Amazon Web Services (AWS) infrastructure in the United States. Please reference the AWS security documentation linked above for more information.

All databases are encrypted at rest.

Our applications encrypt data in transit using TLS/SSL only.

We perform vulnerability scanning and actively monitor for threats.

We actively monitor and log activity across our cloud services.

We use our data hosting provider’s backup services to reduce the risk of data loss in the event of a hardware failure, and rely on monitoring services to alert the team to any failures affecting users.

We maintain a process for handling information security events that includes escalation procedures, rapid mitigation, and communication.

Access to cloud infrastructure and other sensitive tools is limited to authorized employees who require it for their role. Where available, we use Single Sign-On (SSO), two-factor authentication (2FA), and strong password policies to protect access to cloud services.

We follow the principle of least privilege with respect to identity and access management.

We perform quarterly access reviews of all team members with access to sensitive systems.

All team members are required to adhere to a minimum set of password requirements and complexity standards for access.

We provide team members with a company-standard password manager to generate and securely store strong, unique credentials. Company-issued laptops additionally enforce password-complexity and full-disk-encryption policies through our device management.

We conduct risk assessments at least annually to identify potential threats, including considerations for fraud.

Vendor risk is evaluated and the appropriate vendor reviews are performed prior to authorizing a new vendor.