Security
How we protect your data and keep Krll safe.
Last updated: July 20, 2026
Our commitment
Security is fundamental to how we build Krll. We take a layered approach to protecting your data and continuously improve our practices as the product grows.
Data protection
We encrypt data in transit using TLS. We minimize the personal data we collect and store, and sensitive identifiers such as your email and phone number are also kept in hashed form for private contact matching.
End-to-end encryption
Shared tasks and their comments are end-to-end encrypted. Each account publishes only a public key; the matching private keys never leave your devices. Our servers store shared content only as ciphertext and relay encrypted data — we cannot read the contents of your shared tasks or comments.
Authentication
Passwords are stored using bcrypt, a strong one-way hashing algorithm — we never store them in plain text. One-time verification codes are also stored only as hashes, expire quickly, and are rate-limited. If you sign in with Apple, Google, or Microsoft, that provider handles your credentials and we never see your provider password.
Infrastructure
Krll runs on Google Cloud Platform, with a managed PostgreSQL database and cloud file storage that maintain strong physical and network security. We keep our systems and dependencies up to date and apply security patches promptly.
Access control
Access to production systems and personal data is restricted to authorized team members on a need-to-know basis. Administrative access is protected and monitored.
Payments
Subscription payments are processed by Apple through the App Store. We receive only a transaction identifier and subscription status — we never receive or store your card or payment details.
Reporting a vulnerability
We welcome responsible disclosure. If you believe you have found a security vulnerability, email contact@krllapp.com with the details so we can investigate. Please give us reasonable time to address the issue before any public disclosure, and avoid accessing or modifying other users' data.
Incident response
We maintain procedures to detect, respond to, and recover from security incidents. If a breach affects your personal data, we will notify affected users and the relevant authorities as required by law.
Your role
Security is a shared responsibility. Keep your password confidential, use a strong and unique password, keep your devices updated, and be alert to phishing attempts. Contact us if anything looks suspicious.
Contact us
For security questions or to report an issue, email contact@krllapp.com or reach us through our Contact page.