// Trust & Security Report
Craft
Craft is a privacy-first productivity app (notes, tasks, docs, calendar, whiteboards) with integrated AI assistant (GPT-4o, LLaMa, DeepSeek) and extensive integrations (Claude, ChatGPT, VS Code, Raycast, Apple Shortcuts, Lovable, Replit). Multi-platform: iOS, iPad, Mac, Windows, Vision Pro, Android, and web.
Certifications held
2
Maturity
Growth
Trains on your data
No
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on craft.do“We're proud to announce that Craft has achieved SOC 2 Type 2 compliance, which demonstrates our commitment to delivering a secure and reliable platform.”
Verify on craft.do“of learning about it Data Encryption Vendor Management SOC 2 Certification GDPR Compliance Request More Info We’re happy to provide additional security and privacy compliance documentation upon”
> Show 3 unconfirmed / not-held certifications
source: craft.doNo public evidence of ISO 27001 certification on vendor-domain pages. Craft mentions they are happy to provide compliance documentation upon request, but ISO 27001 is not claimed on their security or help pages.
source: craft.doNo public evidence of HIPAA certification or compliance claims on vendor-domain pages. Craft is not marketed as HIPAA-compliant.
source: craft.doNo public evidence of PCI DSS certification on vendor-domain pages.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Not offered
Data region
AWS (primary cloud hosting). Company registered in London, UK; operations also in Budapest, Hungary.
Craft explicitly states: 'Craft does not use your content to train AI models.' When using AI features, only the minimum data required to process a single request is sent to AI providers (OpenAI, LLaMa, DeepSeek). Token usage and costs are recorded, but not user text or request content. Chat history stays on user device with local-first, privacy-first architecture. API requests from external providers are not retained for model training.
// Security controls
Vulnerability management
Ongoing system monitoring for security vulnerabilities; regular third-party penetration testing
craft.doSecurity reviews
Security review process for all system changes; reviews at multiple stages of SDLC
craft.doBreach notification
Commitment to notify users within 72 hours of learning about a data breach
craft.doThird-party audits
Completed third-party audits to validate data protection commitments; willing to provide additional compliance documentation upon request
craft.doAuthentication
Multiple secure login methods: email verification codes, Apple ID, Google authentication
support.craft.doData ownership philosophy
User data is treated as user property; not sold to third parties or used for advertising
craft.do// Products & data scope
Data it handles: Notes, tasks, documents, calendar events, whiteboard content, user-generated data
Available on iOS, iPad, Mac, Windows, Vision Pro, Android, web. Freemium model (free tier + Plus at €4.80-8.00/month). Data encrypted at rest and in transit. Syncs across devices with local-first architecture.
Data it handles: User prompts and content passed to AI models (OpenAI, LLaMa, DeepSeek) for processing only
Does NOT train on customer data. Supports on-device models (LLaMa, DeepSeek) for offline/privacy-first use, and cloud models (GPT-4o) for advanced capabilities. Chat history stored locally on device. Only minimum data sent per request.
Data it handles: MCP connections to other tools (Claude, ChatGPT, VS Code, Raycast, other MCP clients)
Extensibility layer. Users control third-party integration access; can disconnect integrations anytime to stop data sharing.
// At a glance
Pricing model
Freemium: Free tier with full core functionality; Plus tier at €4.80-8.00/month (annual discount available). Education plan available.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Craft Docs Limited's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-09-30. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
craft.do// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.