Privacy notice

Who decides what

Krith is an accounting preparation workspace for accounting firms. A firm decides which of its clients’ documents and ledgers to bring into Krith and why; for that client data, the firm is responsible and we process it on the firm’s behalf, only to provide the service. For the accounts of the firm’s own people, for visitors to this website and for people who write to us, we are responsible.

What we collect

• On this website: what your browser sends to load a page, and a check of whether you are signed in to the workspace, which contacts our sign-in service and sends any sign-in cookie you have. We use no analytics, advertising or tracking, and load no outside fonts or scripts. Our hosting provider, Cloudflare, processes each request, including your IP address, to deliver the site and protect it from abuse.
• People who write to us: the name, email address, firm and note you send through our contact page or to hello@getkrith.com. We keep it to reply to you, and forward it to our team’s inbox. To limit repeated notes, we also keep a one-way digest of the network address a note came from, never the address itself, and clear it after an hour.
• Firm members: name, email address and roles, which our sign-in provider holds for us; which clients each person may work on; and a record of what each person does in Krith, such as confirming facts, approving drafts and signing off a close. When a firm invites someone, we email them the invitation from Krith. When someone sets up or joins a firm by signing in, we email them once, from Krith. We keep a record of each of these emails for 30 days.
• Client data a firm provides: documents the firm uploads, forwards or imports from Google Drive; replies and files a client sends through a private request link; ledger data read from QuickBooks or Xero and payout reports from Stripe, when the firm connects them; and the workpapers, questions, reviews and assistant conversations built from them.
• Client contacts: the email address a firm records for each client request it approves, whether Krith emails the request or the firm shares its private link itself, and the email addresses of the client’s customers that the client provided for payment reminders.

How we use it

To run the service: reading documents, preparing drafts for the firm’s review, checking them against the ledger and keeping their history. We also use it to keep the service secure and working; our operational alerts carry only IDs, states and ages, never client names or documents. We don’t sell information, we don’t use it for advertising, and we don’t use firm or client data to train AI models. Security explains how our agents use AI.

Who else sees it

• The technology providers that run Krith for us, described below, only to provide the service.
• The ledgers, Google Drive and email sender a firm connects, which receive only what the firm authorizes.
• Our own staff see operational metadata (states, counts, errors and IDs) by default. Seeing client content requires a separate permission and a stated reason, and every such access is written to an audit log that cannot be edited.
• Anyone the law requires us to disclose information to.

A person, not the software, approves anything sent to a client or written to a ledger.

Where it is stored

Krith’s database is hosted in the United States. Our technology providers may process information in the United States and other countries where they operate.

The technology behind Krith

Krith is built on established cloud and AI providers. Among them, Cloudflare and Amazon Web Services host the website, the application and its database, and AI models from OpenAI, Anthropic and Google read documents and help prepare the work. Others handle sign-in and send the emails a firm approves. Each processes data to provide Krith’s service and to keep its own service secure, for example by briefly holding requests to detect abuse, and we don’t allow any of them to use firm or client data to train AI models.

Firm and client data is scoped to one firm. Each firm’s records are walled off from every other firm’s in our database, the work Krith does for a firm reads only that firm’s data, and one firm’s data is never used in another firm’s work.

QuickBooks, Xero, Stripe and Google Drive are the firm’s own accounts. Krith reads from them only after a firm member connects them, and writes to a ledger only under a grant the firm approves, one approved entry at a time. A firm can ask us for the current list of providers that process its data, and we tell the firms that use Krith before adding one.

How we protect it

Connections are encrypted in transit, each firm’s data is separated by row-level security, credentials are encrypted before they are stored, and client files stay quarantined until a malware scan clears them. Security has the details.

Cookies and browser storage

We set no advertising or analytics cookies. Signing in uses cookies from our sign-in provider or from Krith itself to keep you signed in; they are not used for anything else. The workspace also stores, in your browser, the page to return to after signing in and whether you left the assistant panel open.

How long we keep it

A firm decides how long its client data is kept: an administrator sets each close’s retention date and can place a legal hold. A few working records, such as assistant conversations, are trimmed automatically.

Before deleting a close, a firm can download its documents, workpapers, reviews and sign-off history. Deleting is recorded and leaves only a minimal receipt of which month was deleted, by whom and why. If a firm leaves, we suspend its workspace without deleting anything, and remaining data is deleted as agreed in writing.

Your choices and rights

If you are a client of an accounting firm, ask your firm first: it decides what is held about you in Krith, and we will help it answer. Firm members, website visitors and people who write to us can ask us to access, correct or delete their information, or object to how we use it, subject to the law that applies to you.

Questions about this notice, or a privacy request? Write to hello@getkrith.com or use our contact page.

Changes

We will update this page when our practices change and change the date above. We tell the firms that use Krith about material changes before they take effect.