Krög X · Vault & security
Logins in a vault, access by rule.
Shared logins live in an encrypted vault, each with a rule for who can use it and where. Teammates sign in without seeing passwords, every seat has two-factor, and any device can be signed out from one place.
01The vault
See the vault as each role.
Switch between Media buyer and Admin, then pick an entry. The rule decides who signs in with it, who sees the password and who can change it.
Storefront admin
••••••••••- Who can sign in with it
- Admins and Media buyers on Outdoor retail
- Where it fills in
- Only inside the Storefront admin profile
- Who can see the password
- Admins, with a reason, logged
- Rotation reminder
- Every 90 days
As a Media buyer, you can
- YesSign in with itFills in inside the Storefront admin profile.
- NoSee the passwordHidden. You sign in without ever seeing it.
- NoChange the ruleOnly Admins change the rule.
02Access rules
Every entry has a rule.
Four questions, answered once per entry by an Admin.
Who
Roles or named people on a client. Media buyers on Outdoor retail, for example.
Where
The profiles an entry may fill into. A storefront login fills only in the storefront profile.
How
Autofill only, or reveal allowed for Admins with a reason. Reveals are logged.
When to rotate
A reminder every 30, 60 or 90 days, and after anyone with access leaves.
The shared vault is for
- Logins whose owner allows them to be shared, like a client's storefront staff login
- Tracking, analytics and reporting tools the client set up for your team
- Anything you would otherwise paste into a chat or a spreadsheet
It is not for
- Not: Ad platform logins that the platform expects to be personal. Those go in each person's personal section, visible to them alone.
- Not: Logins for accounts your team is not authorized to manage.
03Sign-in and devices
Who is signed in, and where.
Protection for the seat itself, before any profile opens.
Two-factor for every seat
Required from the first sign-in, with an authenticator app. No seat can switch it off.
Trusted devices
Each seat lists the devices it is signed in on, with the last time each was used.
Remote sign-out
End every session on a lost or replaced laptop from any other device.
Offboarding in one step
Removing a seat ends its sessions and revokes its vault access at once.
- Planned
Single sign-on
Seats managed from your company's identity provider.
- Exploring
Security keys
Hardware keys as a second factor, next to authenticator apps.
04Commitments
What we commit to.
Krög X is in development, so here is what you can hold us to before it ships.
Published before early access
- A security overview: how the vault is encrypted, where data is stored and for how long.
- The full list of what Krög X records about a seat, and what it never records.
- How to report a security issue, and how fast we respond.
Things we will not do
- Not: Sell or share your workspace data.
- Not: Record page contents, keystrokes or screenshots.
- Not: Show ads inside the browser.
- Not: Build features that conflict with a platform's rules.
Found a security problem in anything Krög runs? Email hello@krog.digital with “Security” in the subject.
Krög X is in development. This page describes what we are building; details can change before early access.
— Early access
Bring your team to Krög X first.
Krög X opens to a small group of teams before the public launch. Tell us how your team works and we'll reach out when a seat is ready.
- Krög clients are invited first
- No launch date until it is ready
- Pricing in writing before anything is billed
- Your feedback sets the order of the roadmap