Where your data lives, and who can reach it.

01 · Data residency

Your data stays in the United Kingdom

Every drawing, task, photograph, certificate and Vault entry is stored and processed in the UK. We do not operate any other storage region, and your project data is not transferred outside the United Kingdom.

• Application — Northflank, on Google Cloud europe-west2 (London).
• Database — Neon, hosted on AWS Europe West 2 (London).
• Files, drawings and photographs — AWS S3, eu-west-2 (London), encrypted at rest.

02 · Encryption

Numbers, not adjectives

TLS in transit throughout. Vault entries are encrypted with AES-256-GCM using a unique 96-bit nonce per entry and a 128-bit authentication tag verified on every read, so tampered data fails loudly rather than returning something plausible and wrong.

No card data ever reaches Graftix. Payment handling sits entirely with Stripe.

03 · The Vault

We cannot read your credentials

Vault entries are encrypted in your browser, under a key derived from a passphrase we never receive. We store ciphertext and wrapped keys and nothing else.

Graftix holds no master key, no per-organisation key and no recovery key. There is nothing on our side that decrypts your entries — not for support, not for diagnostics, and not on request. That is enforced in the software, not just promised in a policy.

Your PIN is a second factor, verified server-side to enforce lockout after repeated failures. Only a bcrypt hash is stored; the PIN itself is never held, and it is not the passphrase.

Organisation recovery is handled by a recovery key your organisation generates and controls. Vault activity is written to an append-only audit log that cannot be edited or deleted, and the log is sealed monthly so historical tampering is detectable.

How the Vault works

04 · AI and your data

Your projects are not training data

• All AI inference runs via AWS Bedrock in the United Kingdom, eu-west-2 (London). Your project data does not leave the UK for AI processing.
• Anthropic does not train its models on data submitted through this route.
• Your data is never used to train AI models.
• Connect your own AI assistant over MCP if you prefer. On that path your assistant's provider handles the requests, under your own terms, so UK-resident inference is not guaranteed.

Read the AI policy

05 · Access control

Every request checked, twice

Authentication and identity run by Graftix itself — your password is stored only as a cryptographic hash in our London database, never held by a third party — with role-based access across the organisation so engineers see their work and directors see the business.

Organisation scoping is enforced twice over: every request checks that a record belongs to your organisation before acting on it, and every database change is restricted to your organisation as well, so one customer can never reach another's data, even if a check were ever missed.

Both checks are covered by automated tests that make real requests against the API.

06 · Uploads

Everything you send us is scanned

Drawings, photographs, datasheets, qualification evidence, signed RAMS — every upload path in the product goes through one scanner before the file is stored, and the verdict is recorded against the object. There is no second door into storage that skips it.

• A single scanning path, so adding a new upload surface cannot quietly bypass it.
• Every scan result is written down, so the question "was that file checked?" has an answer.
• Induction and eForm uploads from outside your organisation go through the same door as everything else.
• Media served on public links is pinned to your own organisation's storage, so a public page cannot be aimed at another customer's files.

07 · Sub-processors

Everyone who touches it

Northflank, Neon, AWS, Anthropic, Cloudflare, Stripe and Resend, each with a defined role and region — plus Apple, Google and Expo, who deliver push notifications to your devices and receive nothing but a device token and the text of the notification itself.

See the sub-processor list

08 · Retention

How long we keep things

• Operational data: subscription lifetime plus 6 years, per the Limitation Act 1980.
• Audit logs: 6 years from the logged event.
• Security and access logs: 1 year. AI usage records: 1 year. Push delivery logs: 90 days.
• After cancellation: 90 days to export, then permanent deletion.
• Backups overwritten within 30 days of the primary data being deleted.

09 · Your rights

Asking us for your data

Full UK GDPR rights with a response inside one calendar month. A data processing agreement is available on request for business customers. Registered with the Information Commissioner's Office under ZC139440.

Your privacy controls