Where your data lives, and who can reach it.

01 · Data residency

Your data stays in the United Kingdom

Every drawing, task, photograph, certificate and Vault entry is stored and processed in the UK. We do not operate any other storage region, and your project data is not transferred outside the United Kingdom.

• Application — Northflank, on Google Cloud europe-west2 (London).
• Database — Neon, hosted on AWS Europe West 2 (London).
• Files, drawings and photographs — AWS S3, eu-west-2 (London), encrypted at rest.

02 · Encryption

Numbers, not adjectives

TLS in transit throughout. Vault entries are encrypted with AES-256-GCM using a unique 96-bit nonce per entry and a 128-bit authentication tag verified on every read, so tampered data fails loudly rather than returning something plausible and wrong.

No card data ever reaches Graftix. Payment handling sits entirely with Stripe.

03 · The Vault

We cannot read your credentials

Vault entries are encrypted in your browser, under a key derived from a passphrase we never receive. We store ciphertext and wrapped keys and nothing else.

Graftix holds no master key, no per-organisation key and no recovery key. There is nothing on our side that decrypts your entries — not for support, not for diagnostics, and not on request. The server will refuse to start if a legacy encryption key is present, so this is enforced at boot rather than promised in a policy.

Your PIN is a second factor, verified server-side to enforce lockout after repeated failures. Only a bcrypt hash is stored; the PIN itself is never held, and it is not the passphrase.

Organisation recovery is handled by a recovery key your organisation generates and controls. Fourteen vault actions are written to an append-only audit log: a database trigger rejects any update or delete, reapplied at every server startup, and the log is sealed monthly into a SHA-256 hash chain so historical tampering is detectable.

How the Vault works

04 · AI and your data

Your projects are not training data

• All AI inference runs via AWS Bedrock in the United Kingdom, eu-west-2 (London). Your project data does not leave the UK for AI processing.
• Anthropic does not train its models on data submitted through this route.
• Your data is never used to train AI models.
• Bring your own provider key if you prefer, billed to you directly. On that path requests go straight to your chosen provider, so UK-resident inference is not guaranteed.

Read the AI policy

05 · Access control

Scoped twice, tested at the wire

Authentication and identity via Clerk, with role-based access across the organisation so engineers see their work and directors see the business.

Organisation scoping is enforced twice over. Every route checks that a record belongs to the caller's organisation before acting on it, and every underlying database write carries an organisation condition in its own WHERE clause — so a cross-organisation request is a no-op at the data layer even if a route check were ever missed.

The guard itself is a single shared function used by the application and by its tests alike, so it cannot drift out of step in one place and not the other. It is verified by integration tests that make real HTTP requests, rather than unit tests that check the logic in isolation and stay green when a route stops calling it.

06 · Uploads

Everything you send us is scanned

Drawings, photographs, datasheets, qualification evidence, signed RAMS — every upload path in the product goes through one scanner before the file is stored, and the verdict is recorded against the object. There is no second door into storage that skips it.

• A single scanning path, so adding a new upload surface cannot quietly bypass it.
• Every scan result is written down, so the question "was that file checked?" has an answer.
• Induction and eForm uploads from outside your organisation go through the same door as everything else.
• Media served on public links is pinned to your own organisation's storage, so a public page cannot be aimed at another customer's files.

07 · Sub-processors

Everyone who touches it

Northflank, Neon, AWS, Anthropic, Cloudflare, Clerk, Stripe and Resend, each with a defined role and region — plus Apple, Google and Expo, who deliver push notifications to your devices and receive nothing but a device token and the text of the notification itself.

See the sub-processor list

08 · Retention

How long we keep things

• Operational data: subscription lifetime plus 6 years, per the Limitation Act 1980.
• Audit logs: 6 years from the logged event.
• Security and access logs: 1 year. AI usage records: 1 year. Push delivery logs: 90 days.
• After cancellation: 90 days to export, then permanent deletion.
• Backups overwritten within 30 days of the primary data being deleted.

09 · Your rights

Asking us for your data

Full UK GDPR rights with a response inside one calendar month. A data processing agreement is available on request for business customers. Registered with the Information Commissioner's Office under ZC139440.

Your privacy controls