Trust

Security, plainly stated.

Security information for this website. Contact us for security and data-handling details specific to KrythicCRM.

This website

The smallest attack surface we could build.

No accounts, no sessions, no cookies, no database, no file uploads, no admin routes. The only dynamic input on the entire site is the contact form.

No third-party code Zero runtime dependencies and zero third-party scripts. The Content Security Policy allows scripts and styles only from this origin — no unsafe-inline, no CDN, no tag manager, no analytics.
Pre-rendered, escaped output Every page is generated at build time from sources in our repository and HTML-escaped on the way out. Client-side code never writes markup into the page.
Hardened transport and headers HSTS, X-Content-Type-Options, X-Frame-Options: DENY, frame-ancestors 'none', a strict referrer policy, and a permissions policy denying camera, microphone, and geolocation.
Minimal data collection The contact form takes a name, email, optional subject, and message, relays them to our inbox, and stores nothing. No tracking, no profiling, no marketing lists.
Automated checks in CI Unit, integration, and end-to-end tests plus a dependency audit and an accessibility scan run on every push. A failure blocks the change.
Spam handling without surveillance The form uses a honeypot field and a timing check rather than a tracking-based CAPTCHA — which is also why it stays accessible to keyboard and screen-reader users.

Additional services

Security for custom engagements.

The following applies to separately agreed custom services, not to KrythicCRM subscriptions.

Your accounts, your keys

Source code, infrastructure, and data live in accounts you own from day one. We work with access you grant and can revoke, not credentials we hold. When an engagement ends, removing our access is a single administrative action on your side.

Least privilege by default

We ask for the narrowest access that lets the work proceed, prefer scoped service accounts over shared logins, and use production data only where there is no workable alternative — with the client's explicit agreement.

Secure-by-default builds

Encryption in transit, secrets in a managed secret store rather than in code, dependency auditing in CI, parameterised queries, server-side authorisation checks, and structured logging that excludes personal data by design.

AI data handling stated in writing

Where an engagement uses an LLM provider, the provider, the data sent, the retention terms, and whether the data may be used for training are agreed with you and documented before anything is sent. Human review sits on any output that carries a consequence.

What we don't claim

The part most vendor security pages leave out.

We distinguish website controls from product assurances. Here is the position documented for this website:

We are not SOC 2 or ISO 27001 certified. If your procurement process requires a certified vendor, we are not that vendor today, and we will tell you so in the first conversation rather than the fifth.
Product hosting is a separate topic. Ask our team for KrythicCRM hosting and data-handling information before purchase.
We have not had a third-party penetration test of this website. The controls above are ours, documented and testable, but they are self-assessed.
We do carry documented accessibility conformance — see the accessibility statement. Where a claim is provisional, we say which part and why.

Security questionnaires are welcome. We would rather answer forty questions honestly than one badge dishonestly.

Disclosure

Reporting a vulnerability.

If you believe you have found a security issue in this site or in software we built, email krythictechnologies@outlook.com with enough detail to reproduce it.

We acknowledge reports within 5 business days.
We will tell you our assessment and intended fix timeline within 20 business days.
We will not pursue legal action for good-faith research that avoids privacy violations, service degradation, and data destruction.
We do not currently operate a paid bug bounty, and we will credit you publicly if you would like that.

Need this in a questionnaire format?

Send us your security review document. We answer it directly, and we mark anything we cannot yet satisfy rather than working around the question.

Get in touch