SECURITY

Security and compliance

Kroons keeps the review comments of your projects. This page tells you how we keep them safe. It shows only what Kroons does today.

Who keeps your data

Maintenance Data Services OÜ, Estonia, makes Kroons and operates the service.
For your project content, we are a processor: we keep it for you and use it only to give you the service.
The servers are in the European Union.

The web app, the API and this site use HTTPS only. A request on HTTP goes to HTTPS.
The web app and the API tell browsers to use HTTPS for one year (HSTS).
The Navisworks plugin connects only over HTTPS.
Kroons sends its emails over TLS 1.2 or 1.3.

We keep passwords only as bcrypt hashes. A password has at least 12 characters.
You can also sign in with a code that we send by email. The code has 6 digits, is valid for 10 minutes and works one time. After 5 wrong codes, it stops.
The answer is the same when we do not know the email address. Nobody can use the sign-in to find out who has an account.
We slow down too many attempts from one person or one network. We never lock your account.
A web session ends after 8 hours without use and after 7 days in all. A plugin session ends after 20 days without use and after 6 months in all.
You see your signed-in devices in the web app, and you can end each one. A new password ends all your other sessions.

Each person has a role in each project: project admin, writer, reader or client. A company admin manages the people of the company.
The database itself decides what each person can see (row-level security). It reads the role again for each request.
A client sees only the external review. The internal work of your team stays internal.
When our support acts for a user, the log records both persons.

The plugin keeps its session key encrypted for your Windows user (Windows DPAPI). It does not keep your password or your sign-in code.
The plugin log contains numbers and ids only: no passwords, no keys and no comment text.
The plugin sends no telemetry. Your model files never leave your computer.
The plugin changes your model only when you use Sync or Autosync: then it reads and writes Navisworks tags.

Stripe takes the payment on its own secure page. Stripe is a PCI DSS Level 1 service provider.
Card data never comes to Kroons.
We check the signature of each message from Stripe before we act on it.

This site and the web app sign each call to each other (HMAC-SHA256). A call is valid for 5 minutes and only one time.
The forms on this site carry a signed token, so a script cannot send them in your name.

Each change writes a row in the log. Project admins see the log of their project.
When somebody edits a comment, Kroons keeps the earlier versions.
Kroons records each export.

This site sets no cookies and uses no analytics and no advertising.
Stripe sets its cookies on stripe.com, not on kroons.co.
Our privacy page lists the companies that work for us (processors) and how long we keep data.

The web app and this site load scripts only from their own address (Content Security Policy).
Other sites cannot show our pages in a frame.
Password links do not go into the server logs.

Did you find a security problem? Tell us by email. Do not put the details in a public place before we fix it.

Read also our privacy page and ourterms.