Where your data lives

Who holds it

Kromdraw is made by Ronkatil B.V., a Dutch private limited company in Beek, Gelderland. There is no parent company and there are no investors, so there is no American entity in the ownership chain to be served an order. If that changes, this page changes first.

Registered address: Plataanstraat 7, 6573 XP Beek, the Netherlands. KvK 96968176 · BTW NL867854571B01.

The machines

The application

One server in Nürnberg, Germany, rented from netcup. It runs the app, the background jobs and PostgreSQL in separate containers. Your boards live in that database, on a disk attached to that machine, which is about as close to "one place" as a running application gets.

What you reach first

kromdraw.com points at Bunny, a Slovenian company. It sits in front of the server and serves the fonts, the scripts and the images. Your browser's connection to Bunny is encrypted, and Bunny's connection to the server is encrypted again. The delivery zone is restricted to Bunny's EU edge nodes.

Pictures, imports and exports

Anything you upload is stored with Bunny in Frankfurt, Germany, and Stockholm, Sweden. That covers the images you drop on a canvas, an archive you import from another tool, and the ZIP an export builds.

Backups

The database is copied continuously rather than nightly. A full copy is taken every night and every write is archived on top of it within five minutes, to Scaleway, a French company, in Amsterdam, the Netherlands. Everything is encrypted before it leaves the server with a key that isn't kept there, so the contents are unreadable to anybody who only has the storage.

A daily check asks Postgres whether the archiving is still advancing and fails in the job queue if it has stalled, which is the failure that otherwise goes unnoticed. Proving that a backup restores is a drill I run by hand, and nothing sends an alert on its own.

Nothing leaves the EU

Every machine above is in Germany or Sweden, and every company holding any part of this is European. There is no step where a board goes somewhere else to be processed and comes back. The subprocessor list names each company and what it can see.

That includes AI. There is none in Kromdraw, so nothing you draw or write on a board is sent to a model provider, and there is no setting that would send it. If that ever changes, this page says so before the feature ships.

Things this site doesn't do

There is no third-party script on any page, no tracking pixel and no advertising network. The fonts come from Kromdraw's own host. They came from Google's font CDN until 25 August 2026, because a font request is a request that tells somebody else which page you're reading. There is analytics, but it is Kromdraw's own: it records the pages you open, on Kromdraw's own server, and no other company receives it. The privacy policy says what it keeps.

What I can't claim

Kromdraw is not ISO 27001 certified. It has not had a third-party penetration test. One person has access to the production server and that person is me. The recovery procedure is written down and I have run it as a drill, but never against a real disaster.

If you're a public body with a procurement checklist, some of those boxes will stay empty for a while.