Technical & Organizational Measures

Last updated10/9/2026

1. Purpose and scope

This document describes the technical and organizational measures (“TOMs”) that ICVR LLC, operator of Craftology (“Craftology”), implements under Article 32 GDPR to protect data processed in the Craftology service. It is incorporated by reference into the Data Processing Addendum (“DPA”) and, where the EU Standard Contractual Clauses apply, constitutes their Annex II.

These measures apply to all Customer data, including creative content, prompts, uploaded media and generated output, whether or not it is personal data.

2. Updates to these measures

Craftology may update these measures to reflect technological and organizational developments, provided that no update materially reduces the overall level of protection of Customer data. The current version is published at craftology.io/security-measures; previous versions are available on request to privacy@craftology.io.

3. Governance and accountability

A named owner (CTO) is accountable for information security and data protection; this document and the related policies are approved by the CEO.
Information-security and data-protection policies are documented, approved, and reviewed at least annually.
Compliance roadmap: SOC 2 Type I (target Q4 2026), SOC 2 Type II (target Q2 2027), TPN (planned, target Q1 2027). No certification is claimed until it is achieved.
Third-party and subprocessor risk is reviewed before engagement (see §16).

4. Personnel

All staff and contractors sign confidentiality agreements before being granted access to Customer data.
Security awareness training at onboarding and annually.
Documented joiner / mover / leaver process; access is revoked on departure within one business day.

5. Access control

5.1 Customer access to the Service

Users authenticate through a central identity provider; sessions are held server-side and referenced by a secure, HTTP-only session cookie.
Role-based access within each Customer organization, with segregation of data by project.

5.2 Internal access to production

Access to production systems and Customer data is granted on a least-privilege, role-based basis and only where needed for a defined operational purpose.
Production access is logged. Access rights to production systems are reviewed at least quarterly and upon any change of role or departure.
Application secrets and credentials are held in a dedicated secrets-management system and are not stored in source code.

6. Tenant and data segregation

Customer data is logically segregated by organization and project, and authorization is enforced server-side on every request.
Stored media is delivered through signed, short-lived URLs via a content-delivery network; storage buckets holding Customer data are not publicly accessible.

7. Encryption

In transit: all external traffic is encrypted with TLS (TLS 1.2 or higher). Internal service-to-service traffic is encrypted using Istio service-mesh mTLS.
At rest: storage volumes, databases, object storage, and backups are encrypted at rest using the cloud providers' encryption (AES-256) with keys managed by the respective provider (Google Cloud, Cloudflare).

8. Infrastructure and network security

The Service is hosted on Google Cloud. Physical and environmental security is provided by Google Cloud and Cloudflare, which maintain SOC 2 and ISO/IEC 27001 attestations.
Production workloads run in isolated private networks. Inbound traffic reaches them only through a managed cloud load balancer and a service-mesh ingress gateway; stored media is delivered through a CDN edge network using signed, short-lived URLs.
Infrastructure is defined as code; changes are version-controlled, reviewed, and deployed through an automated pipeline with progressive (canary) rollout and rollback.

9. Secure development and vulnerability management

Every change requires code review and passing CI checks before merge.
Dependency and container-image vulnerability scanning runs in CI, and builds with unresolved High or Critical findings are blocked from deployment. Newly disclosed vulnerabilities in deployed components are remediated within 7 days (Critical), 30 days (High), and 90 days (Medium), or tracked under a documented, time-limited risk acceptance where no fix is available.
Development, test, staging, and production environments are separated; production Customer data is not used in non-production environments.
Independent third-party penetration testing is on the roadmap - Q1 2027.
Coordinated vulnerability disclosure: reports to security@craftology.io.

10. Logging and monitoring

Centralized application and infrastructure logging, error tracking, metrics, and alerting, with alerts delivered in real time to the engineering team's messaging channels.
Logs are retained for typically 12 months.
Logging minimizes personal data: the free-text content of data-subject requests is not logged, and prompts, uploaded content, and generated output are not written to application logs.
Error tracking and session replay are self-hosted within Craftology's infrastructure, with text and media masking enabled.

11. AI processing controls

AI inference providers are engaged only under a DPA (with SCCs where required) and terms that prohibit training on Customer data; they are listed on the Subprocessors.
Customer content is never used to train models without the Customer's explicit, opt-in permission.
Where a provider retains inputs or outputs — either under its own terms (for example, for abuse monitoring) or as files Craftology stages with the provider to perform a generation — that retention is recorded in Craftology's AI vendor data-retention register. Files staged by Craftology are tracked and deleted on a defined rotation schedule (30 days); provider-side retention under the provider's own terms follows the periods recorded in the register, which is available to Customers on request.
Media depicting or voicing people is handled as set out in DPA §5.1: no facial or voice recognition, no biometric templates or voiceprints, no inference of special-category attributes, and image descriptions limited to non-identifying attributes. Audio is passed to the inference provider as a reference only and is not analyzed by Craftology.
AI-generated output may carry machine-readable provenance information (Content Credentials).

12. Availability, backup, and recovery

Automated, monitored, encrypted backups on a 30-day rotation; backups are restored to production only for disaster recovery.
Backup restoration is tested at least annually.

13. Incident response

A documented incident-response plan defines roles, severity levels, escalation, and communication.
Customers are notified of a personal data breach affecting their data without undue delay and in any event within 72 hours of Craftology becoming aware of it (DPA §8).
Incidents are followed by a post-incident review and tracked corrective actions.

14. Data minimization, retention, and deletion

Non-essential analytics on the platform run only after opt-in consent.
Retention follows the Privacy Policy §6: account data deleted or anonymized within 90 days of account closure; User Content kept until deleted by the Customer, with backup copies for up to 30 days; logs typically 12 months; billing records as required by tax and accounting law; provenance records follow their associated asset.
Transient working copies created during processing are deleted automatically within 30 days.
Deletion is certified in writing on request (DPA §9.5).

15. Data-subject requests

Requests can be submitted by email to privacy@craftology.io. Each request is logged in a ticketing system and tracked against the statutory deadline of one month from receipt, and Craftology assists Customers, as controllers, in responding to requests about their data.

16. Subprocessor management

Each subprocessor undergoes a security and data-protection review before engagement and is bound by a DPA (with SCCs where required) no less protective than the Craftology DPA.
The current list is published at craftology.io/subprocessors; changes are notified in accordance with DPA §6.

17. Contact

Security matters: security@craftology.io · Data protection: privacy@craftology.io