Security
Production is never a surprise.
Croft gives more people the ability to change your software, with explicit permissions and review around what reaches production. This page explains the model in plain terms. For the full picture, bring your platform team and we will walk the architecture end to end.
Hosting & data location
Choose where production lives. Know what that covers.
Regional production hosting
Croft offers a region choice when multiple hosting regions are enabled. The selected region places your production app, its dedicated Croft-managed databases and the edge serving it together. Available regions are shown during setup. Musterworks runs in Croft’s UK deployment.
Production can have its own database, separate from development. Existing production can be moved through an explicit migration flow; the app is offline while its data moves.
The boundaries of that choice
Choosing a production region does not move Croft's control plane, build infrastructure or development workspaces. These run in Croft's home region, North America. External databases and third-party services have their own locations and processing arrangements.
If you have residency requirements, ask us to walk through your full setup, including development data, model providers, backups, access and contractual requirements.
Regional hosting is one part of a data protection assessment. It is not a GDPR certification or a guarantee of compliance. The ICO's international transfer guidance explains the wider responsibilities. Talk through your requirements with us.
Three walls between a request and production.
Everyone works in a copy
Every person gets their own isolated, fully working copy of your application, with its own database and services. Nothing done in a workspace can touch production or anyone else's work.
Changes run before they ship
Every change runs live on a preview with your tests and checks. What gets reviewed is the running product, not a diff in the abstract.
Production sits behind your gates
Changes reach production only through the review and approval flow your engineers define. Sensitive areas always require sign-off, whoever made the change.
Guardrails, precisely.
Engineering sets the rules once. The rules hold for everyone, on every change, without exception.
Scopes
Decide who can touch what. This module yes, that service no. People work freely inside their scope and can't wander outside it.
Trust levels
New users start supervised, with every change reviewed. Trust is earned per person, and engineers can widen or tighten it at any time.
Approval gates
Anything you mark as sensitive, like billing, data, or auth, always requires engineering sign-off before release, no matter who made the change.
Everything on the record
Every request, change, review, and release is logged. If something needs a second look, the whole trail is right there.
Your code and your data.
Your repository stays yours
Croft connects to your repository with scoped credentials that you can revoke at any time. We never take ownership of your code or your infrastructure.
Encrypted in transit and at rest
Data is encrypted on the wire and on disk. Every workspace is isolated. It sleeps when idle and wakes with its work intact, and nothing in one can reach another.
No training on your code
Your code and your data are never used to train models. They are used to do your work, and for nothing else.
A full audit trail
Every request, change, review, and release is recorded: who asked, what changed, who approved it, and when. Exportable, always.
Least privilege by default
Workspaces get the narrowest credentials that let them do their job. Production secrets never enter preview environments.
Report a concern
Found something that worries you? Write to [email protected] and you will hear back from an engineer, not a queue.
We would rather show than tell.
Bring your platform team. We will walk through isolation, gates, and the audit trail on a live system. Thirty minutes, no slides.