Customer Portal & Logins — Included in Every krafteq Delivery

No — and because that confusion is common, we say it plainly. The krafteq Customer Portal is the interface between your business and krafteq: set-up status, documents, change requests, invoices. It is not a portal your own customers log into — in the product krafteq Handwerk, exchange with your clients deliberately runs by email and document, and nobody outside your business gets an account. If you need a portal for your own customers, that is a custom initiative and belongs in the initial consultation.

Both are delivered together. The login stack provides centralised sign-in with Keycloak — email and password, optional single sign-on via OIDC, MFA, roles, audit log, tenant separation, and a GDPR-compliant account lifecycle. The Customer Portal is the interface between you and krafteq: status, contracts, Data Processing Agreements (DPAs), change requests, change overview, invoices, and backup status — all in one place. Both are active from day one, as soon as your software is running.

They are not sold separately. Both are part of every krafteq delivery — no extra charge, no separate licence. Operating them is already covered by krafteq operations (an annual service per installation, with the first year included in the purchase). We deliberately do not communicate a unit price, because the bundle is the point: you receive the complete finished building blocks, not a minimal login solution with costly extensions.

If your business uses Microsoft 365, we configure Single Sign-On via OIDC against Microsoft Entra ID. Your staff sign in with their familiar Microsoft account; on- and offboarding runs centrally through your Microsoft 365 user management. Setup typically takes a few hours on the krafteq side and requires an OIDC app registration in your Microsoft tenant. The standard email-and-password login remains available in parallel.

Standard retention is a minimum of 90 days. Audit logs are exportable as structured data and contain login events, role changes, critical data access events, and account lifecycle actions. Longer retention periods — for example, if your own information security management system (ISMS) policy requires 12 or 24 months — are calculated transparently as an add-on within krafteq operations.

The right to erasure (Art. 17 GDPR) is implemented in the IAM and in the Portal. We can delete individual accounts and associated personal data in a GDPR-compliant manner — either via self-service by you as the account owner, or upon written request. Audit log entries containing personal data are anonymised or deleted in the same operation, unless a statutory retention obligation applies.

Yes — custom branding is standard. You use the Portal under your own domain (for example, portal.yourbusiness.com) and your own logo. Colours and fonts can be adjusted. What we deliberately do not offer is a fully white-labelled portal with an independent brand and no krafteq association — that is not compatible with the productised model.

No. The Portal is the layer between your business and krafteq — not a resale tool for an independent brand. Logo, domain and colours can be adjusted; independent IP cannot. If you wish to distribute software under your own brand, that is an initiative of its own — please raise it with us in a free consultation.

No. Each krafteq client is a separate, strictly isolated tenant. A sign-in that grants access at client A and client B at the same time is deliberately not supported, as it would undermine tenant separation. Within your own tenant, you can use single sign-on against Microsoft 365 or Google Workspace.

In that case you use the standard login with email and password, optionally with MFA. That is the default — no Microsoft account, no Google account required. Self-service password reset via confirmed email delivery is standard, so you can invite your staff without any IT effort. Should you wish to introduce SSO at a later stage, it can be configured retrospectively without any loss of data.

Each krafteq client receives a dedicated logical tenant in Keycloak (a Realm) and a dedicated database instance or at minimum a dedicated schema. Application logic enforces tenant membership at every data layer. A user belonging to one client can never access — technically or logically — the data of another client. Audit log entries are likewise separated per tenant.