Security and privacy

Chat messages, chat titles, the files attached to a chat and the files created in it are stored encrypted. The key that opens them is protected by a separate encryption password that you choose.

• The encryption password never leaves your device. The key is derived from it on the device (Argon2id), and the server keeps your private key only in encrypted form.
• Our servers hold only your public key: they can encrypt new messages for you but cannot open stored chats.
• Krebsiti's admin tools have no way to show your chats, and our staff cannot decrypt them.
• If you forget the encryption password, nobody, Krebsiti included, can recover your chats. Resetting it deletes them permanently.
• Chats saved before an account set up its encryption password stay in their earlier, unencrypted form until they are deleted.

To write an answer, your message and the material it needs are processed in readable form by our server and sent to the AI providers listed in the privacy policy, such as OpenAI for answers and Google Cloud Vision for reading text in images.

Your messages are not stored in readable form. While a request runs, an attached file is held in the server's memory for up to 10 minutes.

Some data has to stay readable for the service to work with it: files in AI Studio, Work data (clients, cases and case files) and the documents uploaded to the Analyzer. They are protected by sign-in and permissions, not by your encryption password. Analyzer reports are encrypted once your account has set up encrypted chat.

• Sign in with email and password, Google or Apple.
• Passwords are stored only as bcrypt hashes.
• After three wrong passwords the account locks for 30 minutes; a personal account can be unlocked sooner from a link sent by email.
• Optional two-factor sign-in with a one-time code sent by email or SMS.
• A list of the devices that signed in, and sign-out of all other devices or everywhere.

• Chats are kept until you delete them. Deleting a chat removes it and its files permanently.
• You can delete your account yourself on the web, on the desktop or on iPhone. It is deleted 30 days after the request; signing in during that time cancels the deletion.
• Records that must be kept by law, such as accounting records, remain after an account is deleted.
• A company agent's login is removed by the company's administrator.

Card payments are made on Bank of Georgia's payment page, so Krebsiti never sees or stores your card number. For a saved card, only the bank's reference and a masked number are kept. On iPhone, purchases go through Apple's App Store.

Krebsiti's servers are hosted by Hetzner in Germany, and files are stored with Cloudflare. Connections to krebsiti.com use HTTPS.

The full list of service providers, and what each one receives, is in the privacy policy.