Security and data protection
Graftix holds drawings, certificates, device schedules and credentials for buildings you do not own. This page sets out how that is protected, what we can and cannot access, and exactly who processes it on our behalf.
01 · Data residency
The region is set when your organisation is created and cannot be changed afterwards, because moving live tenant data between jurisdictions is not something that should be a settings toggle.
02 · Encryption
TLS in transit throughout. Vault entries are encrypted with AES-256-GCM using a unique 96-bit nonce per entry and a 128-bit authentication tag verified on every read, so tampered data fails loudly rather than returning something plausible and wrong.
Key derivation
Argon2id — 64 MiB memory, 3 iterations, parallelism 1. Falling back to PBKDF2-HMAC-SHA256 at 600,000 iterations where WebAssembly is unavailable. The algorithm used is recorded per keypair.
No card data ever reaches Graftix. Payment handling sits entirely with Stripe.
03 · The Vault
Vault entries are encrypted in your browser, under a key derived from a passphrase we never receive. We store ciphertext and wrapped keys and nothing else.
Graftix holds no master key, no per-organisation key and no recovery key. There is nothing on our side that decrypts your entries — not for support, not for diagnostics, and not on request. The server will refuse to start if a legacy encryption key is present, so this is enforced at boot rather than promised in a policy.
Your PIN is a second factor, verified server-side to enforce lockout after repeated failures. Only a bcrypt hash is stored; the PIN itself is never held, and it is not the passphrase.
Organisation recovery is handled by a recovery key your organisation generates and controls. Fourteen vault actions are written to an append-only audit log: a database trigger rejects any update or delete, reapplied to both regional databases at every startup, and the log is sealed monthly into a SHA-256 hash chain so historical tampering is detectable.
04 · AI and your data
05 · Access control
Authentication and identity via Clerk, with role-based access across the organisation so engineers see their work and directors see the business.
Organisation scoping is enforced twice over. Every route checks that a record belongs to the caller's organisation before acting on it, and every underlying database write carries an organisation condition in its own WHERE clause — so a cross-organisation request is a no-op at the data layer even if a route check were ever missed.
The guard itself is a single shared function used by the application and by its tests alike, so it cannot drift out of step in one place and not the other. It is verified by integration tests that make real HTTP requests, rather than unit tests that check the logic in isolation and stay green when a route stops calling it.
06 · Sub-processors
Anthropic, AWS, Neon, Clerk, Replit, Stripe and Resend, each with a defined role, processing location and data processing agreement. The authoritative list lives in the Privacy Notice so the two cannot drift apart.
07 · Retention
08 · Your rights
Full UK GDPR rights with a response inside one calendar month. A data processing agreement is available on request for business customers. Registered with the Information Commissioner's Office under ZC139440.
Procurement
Tell us what your process requires and we will answer it directly, including anything not covered on this page.