// Trust & Security Report
Craft Docs Limited
Craft is a privacy-first productivity app (notes, tasks, docs, calendar, whiteboards) with integrated AI assistant (GPT-4o, LLaMa, DeepSeek) and extensive integrations (Claude, ChatGPT, VS Code, Raycast, Apple Shortcuts, Lovable, Replit). Multi-platform: iOS, iPad, Mac, Windows, Vision Pro, Android, and web.
Certifications held
2
Maturity
Growth
Trains on your data
No
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on craft.do“Craft achieved SOC 2 Type 2 compliance on April 18, 2023. An independent auditor has rigorously assessed our security controls and confirmed that they meet the criteria set by the American Institute of Certified Public Accountants (AICPA). Craft commits to maintaining the certification on an ongoing basis, with annual renewal planned.”
Verify on craft.do“Craft's privacy policy helps the company comply with data privacy laws, such as the GDPR. Craft does not sell user data to third parties, does not use it for advertising, and has undergone third-party audits to validate commitments. Users can request deletion of personal information.”
> Show 3 unconfirmed / not-held certifications
source: craft.doNo public evidence of ISO 27001 certification on vendor-domain pages. Craft mentions they are happy to provide compliance documentation upon request, but ISO 27001 is not claimed on their security or help pages.
source: craft.doNo public evidence of HIPAA certification or compliance claims on vendor-domain pages. Craft is not marketed as HIPAA-compliant.
source: craft.doNo public evidence of PCI DSS certification on vendor-domain pages.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Not offered
Data region
AWS (primary cloud hosting). Company registered in London, UK; operations also in Budapest, Hungary.
Craft explicitly states: 'Craft does not use your content to train AI models.' When using AI features, only the minimum data required to process a single request is sent to AI providers (OpenAI, LLaMa, DeepSeek). Token usage and costs are recorded, but not user text or request content. Chat history stays on user device with local-first, privacy-first architecture. API requests from external providers are not retained for model training.
// Security controls
Vulnerability management
Ongoing system monitoring for security vulnerabilities; regular third-party penetration testing
craft.doSecurity reviews
Security review process for all system changes; reviews at multiple stages of SDLC
craft.doBreach notification
Commitment to notify users within 72 hours of learning about a data breach
craft.doThird-party audits
Completed third-party audits to validate data protection commitments; willing to provide additional compliance documentation upon request
craft.doAuthentication
Multiple secure login methods: email verification codes, Apple ID, Google authentication
support.craft.doData ownership philosophy
User data is treated as user property; not sold to third parties or used for advertising
craft.do// Products & data scope
data: Notes, tasks, documents, calendar events, whiteboard content, user-generated data
Available on iOS, iPad, Mac, Windows, Vision Pro, Android, web. Freemium model (free tier + Plus at €4.80-8.00/month). Data encrypted at rest and in transit. Syncs across devices with local-first architecture.
data: User prompts and content passed to AI models (OpenAI, LLaMa, DeepSeek) for processing only
Does NOT train on customer data. Supports on-device models (LLaMa, DeepSeek) for offline/privacy-first use, and cloud models (GPT-4o) for advanced capabilities. Chat history stored locally on device. Only minimum data sent per request.
data: MCP connections to other tools (Claude, ChatGPT, VS Code, Raycast, other MCP clients)
Extensibility layer. Users control third-party integration access; can disconnect integrations anytime to stop data sharing.
// At a glance
Pricing model
Freemium: Free tier with full core functionality; Plus tier at €4.80-8.00/month (annual discount available). Education plan available.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Craft Docs Limited's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
craft.do