Security
Payroll, SSNs and tax IDs, handled as evidence.
Compliance data is the most sensitive data a firm holds. Here is how Kreto stores it, who can see it and what a model is allowed to read.
Models read redacted text.
Social Security numbers, EINs, and bank account and routing numbers are redacted from a document's extracted text before a model reads it. People's names are not removed yet. A scanned page with no text layer is first read by a vision step, and its output is redacted the same way before anything else reads it.
Security practices.
Encryption
Documents and records are encrypted at rest with AES-256. Credentials and SSN fields are also wrapped with AWS KMS keys that rotate on a schedule. Data in transit is encrypted with TLS 1.2 or higher.
Tenant isolation
Every database table has row-level security policies, and queries are tenant-scoped at the application layer, with a post-fetch check that raises on any row that crosses a firm boundary.
People decide
Kreto reads, checks and drafts. No response goes to a government agency without a person's review and approval.
Hash-chained audit trail
Every action is logged to an append-only audit table with SHA-256 hash verification. The database refuses any edit or deletion of an audit record from every application role, firm administrators and Kreto staff included, and an altered record no longer matches its hash.
Access controls
CPA firm members see every employer in their firm. Employer users see only their own company.
Infrastructure
Our application runs on AWS with VPC isolation, private subnets and access logging; the database is a managed Supabase service. Customer data is stored in US regions (AWS us-east-1 and us-west-2).
Portal logins
State-portal logins sit in a credentials vault, and every reveal is logged.
The chain
Every record carries the hash of the one before it.
Receipt, draft, review, approval. The database hashes each audit event with SHA-256 and links it to the one before. A daily check re-derives the previous day's hashes and links, and a weekly job re-walks every firm's whole chain. A break is flagged, never hidden.
Where the audits stand.
- SOC 2Audit in progressCovers our security, availability and confidentiality controls. No report has been issued yet.
- Penetration testPlannedAn independent test is planned. A summary will be shared under NDA once complete.
- SIDES E-ResponseBuiltSIDES E-Response: built; NASWA certification in progress. Per-state enrollment is not complete yet.
Who processes your data.
The services Kreto uses to run, with what each one does. The privacy policy has the full terms.
- SupabaseDatabase and authentication.
- AWSHosting, storage and keys.
- AnthropicThe language model that reads redacted text.
- ResendTransactional email.
- PostHogProduct analytics.
- StripeBilling.
Need our security documentation?
Independent penetration testing is planned; we will share a summary under NDA once complete. Or talk through your firm's requirements.