How we protect GrainQL today, and how to tell us when something is wrong.
The standards we follow, where your data lives and how we handle it.
Analytics data is stored and backed up in ISO 27001 certified data centers in Finland.
Every connection to GrainQL uses modern TLS. Backups are encrypted too.
Each workspace's data is kept separate, and every request is checked against it.
Sign-in runs through Auth0, and every teammate has their own role. We never store passwords.
Production systems are kept patched, monitored and open only to the people who run them.
A data processing agreement, EU Standard Contractual Clauses and a public list of every provider.
We answer security questionnaires and share more detail with your team on request. GrainQL does not hold its own SOC 2 or ISO 27001 certificate yet.
Email security@grainql.com with what you found, how to reproduce it and the impact you expect. A proof of concept or screenshots help.
We will not take legal action against research that follows these rules.
With your permission, we credit you here and in the release notes for the fix.
For how we handle personal data, read the privacy page and the privacy policy.