Security
Security & data handling
Kredal handles sensitive documents — trade licenses, passports, Emirates IDs, UBO declarations. Here is exactly how we protect them.
Private storage, always
Every document lives in a private storage bucket. There is no public URL for any file — access is only ever granted through short-lived signed URLs generated server-side for an authenticated, authorized workspace member.
Row-level security on every table
Every table in our database enforces row-level security scoped to your workspace. A workspace member can only ever see the companies, documents, and reports that belong to their own workspace — never another client's data.
Role-based access within a workspace
Consultant workspaces support owner, admin, member, and read-only viewer roles. Viewers can see a client's file but cannot upload, edit, or delete anything.
Every action is logged
Company creation, document uploads and deletions, questionnaire changes, assessments, and report generation are all recorded in an append-only audit log.
You control deletion
You can delete any uploaded document at any time. We do not train AI models on your documents.