Security & data
The answers your IT department will ask for
Written for whoever has to sign off on a new tool. Everything below traces to our published policies or to a documented feature — and the things we cannot claim are listed just as plainly.
Facts
How KRON handles your data
- Who operates the service?
- Osirios Limited, Business Registration Number (BRN) C23202421, registered in Mauritius. Full details are in the Terms of Service.
- Who owns the data we put in?
- You do. As between you and Osirios Limited, you retain ownership of your Customer Data — files, project inputs and outputs. We hold only a limited licence to host, process and display it as needed to run the service and comply with law.
- Which law applies to personal data?
- The Mauritius Data Protection Act 2017, and the EU/UK GDPR for individuals located in the EEA and the UK. Osirios Limited is the data controller. See the Privacy Policy.
- Where is data processed?
- In Mauritius and in the other countries where we and our service providers operate. Where a cross-border transfer requires safeguards, contractual protections and other recognised mechanisms are applied.
- Are card details stored?
- No. Payments go through a third-party payment provider. We do not normally store full card details — only transaction-level information such as plan, billing period, status, transaction identifiers and invoice details.
- How long is data kept?
- Only as long as needed to run the service, keep security logs, meet legal obligations such as tax and accounting, and resolve disputes. After an account is terminated, some data is retained for a limited period for recovery, security and billing records; backups persist a little longer because of backup cycles.
- What access control is there?
- The administrator creates each employee account and selects the features it can reach with a per-feature checkbox list, changeable at any time. Employees log in with a code sent to their email. Only the administrator has a My Account area.
- Is activity auditable?
- Yes. The activity log records every operation in the program, including employees' actions — parts added and deleted and any change made — filterable by date, action and employee. Inside a document, the history shows who accepted or cancelled it and when, and comments cannot be deleted.
- What about material certificates?
- Mill certificates attach to a goods received note (GRN) line and are inherited automatically by every remnant cut from that bar, which is how a finished part stays traceable to the certificate of the steel it came from.
- What runs on shop machines?
- Nothing. KRON Cutting runs in the browser; there is no client software to install or patch.
Plainly
What we do not claim
A specific "no" is worth more to you than a vague "yes". If any of these is a blocker, say so early and we will tell you honestly whether and when it changes.
No SOC 2, ISO 27001 or comparable certificationWe hold none today and will not imply otherwise. If a certification is a hard requirement for your procurement process, tell us — it affects what we prioritise.
No uptime SLA outside EnterpriseWe aim for a reliable service but do not guarantee uninterrupted availability on the self-serve plans. A contractual SLA is part of an Enterprise agreement.
No on-premise deploymentKRON is a hosted service. On-premise is on the roadmap and not available today — see the roadmap on the About page.
No signed DPA out of the boxIf your organisation requires a data processing agreement, ask and we will work through it rather than pretending one is already in place.
Contact
Security or privacy question?
Write to support@kroncutting.com — including requests to access, correct, delete or export personal data, which are handled under the Privacy Policy. You can also raise a complaint with the Mauritius Data Protection Commissioner or your local EU/UK supervisory authority.
One system for your metal-cutting floor
It runs in your browser — nothing to install on shop machines. Accounts open shortly; tell us about your shop and we will come to you first.