Kronuvo-controlled
Service governance, customer-facing configuration and provisioning, governed engineering changes, DNS/SSL-facing controls where configured, supplier oversight, incident coordination and compliance evidence.
Kronuvo Web · Service Trust
Hosting & Web Infrastructure Services
Service-specific transparency for security, privacy, resilience and shared responsibilities. This page describes current operational controls and provider relationships; it does not claim a certification that has not been awarded.
Service scope
What this trust profile covers.
Provider-controlled
Underlying hosting datacenters, physical infrastructure, provider platform operations and other controls operated directly by the upstream hosting provider. Provider-owned controls are not represented as Kronuvo-owned.
Customer-controlled
Customer content, application choices and customer-managed credentials or configuration outside the managed Kronuvo scope remain the customer’s responsibility unless an applicable service term states otherwise.
Service providers and subprocessors
Providers that may support Kronuvo Web.
Kronuvo evaluates critical providers before relying on them for material service or data-processing functions. The role and data involved depend on the customer configuration.
ResellersPanel / Hepsia
Role: upstream hosting platform and customer hosting control plane. Depending on the service and customer use, this provider may process hosted content, account/service information and operational metadata needed to deliver hosting.
Location model: available hosting locations are provider-defined and the actual location is account/service specific.
Cloudflare
Role: DNS, edge, domain-delivery and related security/traffic processing where Kronuvo configures Cloudflare for the service. The exact data processed depends on the enabled features and traffic path.
Engineering providers
Kronuvo-owned, self-hosted Forgejo and Woodpecker infrastructure support source management, build validation and release assurance evidence. Customer-hosted production content is not intentionally copied into Kronuvo compliance evidence.
Material provider or processing-role changes are reviewed before production adoption. Where law or contract requires advance notice or authorization before a new subprocessor begins processing personal data, Kronuvo applies that requirement before the affected processing begins.
Privacy lifecycle
Requests, retention and provider boundaries.
Privacy requests
Requests for access, correction or deletion of applicable personal information can be submitted through Kronuvo’s published privacy/contact channel. Identity and authority are verified before disclosure or modification, and provider-controlled actions are routed to the responsible provider when necessary.
Retention and deletion
Retention is based on service need, contract and applicable law. Kronuvo does not claim deletion from provider-controlled backups until the applicable provider lifecycle has been verified.
Security and recovery
Kronuvo uses governed change controls, software security scanning, supplier review, incident procedures and continuity planning. Backup availability is not represented as proven recoverability unless a successful restore or authoritative provider restore evidence exists.
Assurance status
CSA STAR Level 1 self-assessment is in governed release validation.
Kronuvo Web has completed all 283 CAIQ v4.1 responses and mapped all 207 CCM v4.1 controls, including transparently disclosed gaps. The submission workbook has been rendered and schema-validated. Release integrity checks, independent review and production validation remain before external CSA submission. Kronuvo will not state that the service is STAR-listed or certified unless and until CSA publishes the applicable external record.