Security

Version: v1.0
Last updated: 8 September 2026

Security and confidentiality of data entrusted to neuronxcrm are central to how the service is designed. This page describes Kraken Labs’ main commitments regarding security, hosting, backups, tooling, and incident management.

1. Hosting and data location

• Application hosting: The neuronxcrm platform (application, APIs, databases) is hosted with Scaleway on infrastructure located in France (Paris region), within the European Union.
• Transactional email: Platform notifications are sent via Scaleway TEM as the primary sender, with Brevo SMTP as fallback.
• Optional Google services: When customers connect Gmail or enable Gemini-powered features, related processing occurs under Google’s applicable terms and locations for those services.
• Default posture: In normal operation of the core platform, personal data is processed on EU infrastructure. Optional third-party integrations are customer-enabled and documented.

2. Architecture, isolation, and encryption

• Environment separation: Development/test environments are separated from production. Remote backups use dedicated object-storage buckets with their own security and lifecycle rules.
• Encryption:
  • In transit: communications between browsers/clients and neuronxcrm are protected with HTTPS/TLS.
  • Backups: backups are compressed and encrypted before transmission to storage.
  • Admin workstations: technical administration workstations use full-disk encryption (BitLocker or equivalent).
• Multi-tenant isolation: tenant-scoped data is isolated using tenant_id keys and PostgreSQL row-level security (RLS).
• Backup lifecycle: backups are retained for a maximum of 30 calendar days, then deleted automatically via object-storage lifecycle rules.

3. Access management

• Least privilege: access to data and environments is limited to operational need. Privileges are reviewed regularly.
• Strong authentication (MFA): infrastructure admin accounts (for example Scaleway) are protected with MFA (TOTP and/or passkey) where available, with recovery codes stored in a secure vault.
• High-entropy password rotation: for critical accesses without native MFA, Kraken Labs applies documented high-entropy passwords generated by a vault, with regular rotation and execution traceability.

4. Backups and continuity

• Automated backups are performed with dedicated tooling and scheduled jobs according to the backup policy.
• Backup confidentiality and integrity rely on local compression/encryption, HTTPS transfer, and private storage buckets.
• Backups are used only for restoration and incident management.

5. Incidents and personal-data breaches

Kraken Labs maintains a formal security incident procedure covering detection, qualification, containment, analysis, notification, remediation, and lessons learned.

When an incident constitutes or may constitute a personal-data breach affecting processing performed for a Customer, Kraken Labs informs the affected Customer without undue delay and, where possible, within twenty-four (24) hours of becoming aware, with information reasonably available at that time.

Notification does not constitute automatic admission of fault or liability beyond applicable contractual terms.

6. Development, source code, and AI tooling

6.1. Source code and repositories

neuronxcrm source code is versioned via Git and GitHub in repositories reserved for code and technical artefacts. Production personal data, production logs, passwords, secrets, and database backups are not stored on GitHub.

6.2. AI assistance for development

Kraken Labs may use AI-assisted development environments (for example Cursor) under privacy configurations that limit retention and reuse of code data for vendor model training where such options exist. Production personal data is not sent to these tools by default; exceptional diagnostic use is minimised, documented, and anonymised/pseudonymised where possible.

6.3. Product AI features

Optional product AI features (for example Gemini-assisted metadata proposals from screenshots/video) require human approval before metadata installation. Gmail Google user data is not used to train general-purpose AI models (see Privacy Policy — Limited Use).

7. Responsible access and customer responsibilities

Authorised Kraken Labs personnel use access only for service needs, keep credentials confidential, and report security incidents without delay.

Customers remain responsible for configuring their tenants, choosing what data to store, managing user rights, and deciding whether to connect third-party integrations such as Gmail.

8. Transparency and audits

Customers may request information reasonably necessary to demonstrate compliance, under the modalities of the DPA (including reasonable audit rights).