How craaft looks after your boards

Signing in

With a password, or with Google, GitHub or LinkedIn.

• Passwords are hashed with bcrypt and never stored as text
• An account made with a password confirms its email address first
• Two-factor sign-in with an authenticator app, with its secret encrypted at rest, and 10 single-use recovery codes
• Each code works once, and 10 wrong codes in 15 minutes pause the second step for 15 minutes
• Sign-in attempts are rate limited for each account and each IP address

Lost your phone and your recovery codes? Email us from the account’s own address. We turn two-factor off only after checking it’s you, and we email you when we do.

Staying signed in

What keeps you signed in, and what signs you out.

• Sessions live on our servers. Your browser holds only an HTTP-only, same-site cookie
• A session lasts 30 days from sign-in
• Changing your password signs out every other session and disconnects every connected app
• Turning two-factor on or off signs out your other sessions
• Every change you make in the app carries a CSRF token

Agents get your access, never more

An agent acts as you, with your boards and your permissions.

• Claude and other MCP clients connect with OAuth 2.1 and PKCE, so nobody copies a token around
• Access tokens last 1 hour. Refresh tokens change on every use, and reusing an old one ends that connection
• Personal access tokens are shown once and stored only as a SHA-256 hash
• Tokens can’t change billing, two-factor or API keys. Those need you, signed in
• Each token is rate limited: bursts of 60 requests, then 1 a second
• Remove an app in Settings under Connected apps, or a token under API keys

Who can see what

Access is checked on every request, not just when you open a page.

• Encrypted in transit, and at rest on Google Cloud
• Board access is checked inside the database query itself, so a board you can’t open looks the same as one that doesn’t exist
• Private boards are seen only by the people added to them. Workspace owners and admins see every board
• Public links are off until you turn one on, and turning one off ends that URL for good
• Files download in a sandbox, so a file can’t run as a page in your browser

Who else touches your data

5 services, each for one job. We don’t sell or share your data.

• Google Cloud hosts the app, the database and your files
• Paddle runs billing. We never see your credit card details
• Resend sends our email, and receives mail sent to a board’s email-to-card address
• OpenRouter, only on boards that turn on AI cards, and never with a provider that stores or trains on the text
• Plausible counts visits to these public pages without cookies. It doesn’t load in the app

The privacy policy has the detail.

Taking your data with you

• Export any board as JSON or CSV, on every plan
• Deleting your account removes it, the workspaces you own and the files you uploaded, and cancels Pro

What we don’t have

Better you hear it here than in a security review.

• No SAML single sign-on or SCIM provisioning
• No SOC 2 or ISO 27001 certification
• No choice of the region your data is stored in

Found something?

Email support@craaft.io with what you found and how to see it again. Please test only against your own account and boards. We usually reply within a day.