Graypie — Security

Last updated: October 1, 2026

Security is foundational to Graypie. As a Business Operating System that holds your sales, inventory, finance, payroll, and customer records, we design the Graypie platform (https://graypie.com) to keep your data isolated, encrypted, and available. This page explains the measures we take and the shared responsibilities between us and you.

1. Our Commitment

We build Graypie with a security-first mindset: least privilege by default, defense in depth, and secure-by-design engineering. We continuously review and improve our controls as the Service and the threat landscape evolve.

2. Infrastructure & Hosting

• The Service runs on reputable cloud infrastructure for application hosting and on managed, cloud-hosted PostgreSQL for data storage.
• Our providers operate hardened data centers with physical security, redundancy, and environmental controls.
• Production, build, and administrative access is restricted to authorized personnel and protected by strong authentication.

3. Encryption

• In transit: all traffic to and within the Service is encrypted using TLS (HTTPS). We use modern cipher suites and redirect insecure requests.
• At rest: data stored in our managed database and backups is encrypted at rest by our infrastructure providers.
• Secrets: application secrets and credentials are stored in protected environment configuration, never in source control, and are scoped to the environments that need them.

4. Tenant Isolation & Data Separation

Graypie is multi-tenant, and strong tenant isolation is a core part of our design:

• Every business's records are tagged to its tenant and protected by database-level Row-Level Security (RLS): policies in the database enforce that queries only ever see the current business's rows, independent of application logic.
• The application connects to the database using a restricted, non-privileged role that cannot bypass these row-level policies.
• Tenant-isolation policies are baked into our database migrations and enforced by an automated check in our build pipeline, so a deployment fails if any tenant-scoped table is missing its isolation policy. This makes "every table is isolated" a verifiable, continuous guarantee rather than a manual promise.

5. Authentication & Account Security

• Passwords are stored only as salted, one-way cryptographic hashes — never in plaintext — and are validated against strength requirements.
• Two-factor authentication (2FA) is supported: after a password, a one-time passcode (OTP) step adds a second factor.
• Trusted devices: you can mark a device as trusted to streamline repeat sign-ins, and you can review and revoke trusted devices at any time, including "sign out everywhere."
• Account controls for teams: owners and managers can manage team members, reset a member's password, and revoke a teammate's trusted devices.
• Sessions are protected and can be invalidated; sensitive cookies are configured with appropriate security attributes.

6. Authorization & Access Control

• Role-based access control (RBAC): access to features and data within a business is governed by roles and granular permissions that owners configure (for example, cashier, manager, owner).
• Server-side checks enforce permissions on every sensitive action — the user interface hides what you cannot do, and the backend independently verifies it (defense in depth).

7. Application Security & Secure Development

• Secure development lifecycle: changes go through code review before release.
• Dependency management: we track and update third-party dependencies and monitor for known vulnerabilities.
• Input handling: we use parameterized database access and framework-level protections to mitigate injection, cross-site scripting, and similar risks.
• Migration & schema guardrails: database changes are applied through versioned, reviewed migrations, including the RLS enforcement check described in Section 4.
• Least privilege is applied to application and infrastructure credentials.

8. Payment Data

For paid subscriptions, payments are handled by established third-party payment processors. We do not store full payment-card numbers on Graypie systems. Card data is transmitted directly to the processor, which maintains its own compliance (such as PCI DSS). Any in-app "cash drawer" and sales figures you record are your Business Data and are protected like your other records.

9. Logging, Monitoring & Alerting

• We maintain application and security logs to support debugging, abuse detection, and incident response.
• We monitor for errors and anomalous activity and investigate alerts.
• Access to logs is restricted to authorized personnel.

10. Backups, Availability & Disaster Recovery

• Our managed database provider maintains regular, encrypted backups with point-in-time recovery capabilities.
• We design the Service for resilience and work to restore service quickly in the event of disruption. Recovery objectives are reviewed as the Service matures.

11. Vulnerability Management

• We apply security updates to our platform and dependencies on a risk-prioritized basis.
• We periodically review our application and infrastructure for weaknesses and remediate findings according to severity.

12. Personnel Security

• Access to production systems and customer data is granted on a least-privilege, need-to-know basis and is removed when no longer required.
• Personnel are bound by confidentiality obligations.

13. Sub-Processor Security

We select sub-processors that maintain appropriate security practices and bind them by contract to protect data. See our Privacy Policy (Sub-Processors) for the categories of providers we use.

14. Incident Response & Breach Notification

• We maintain an incident-response process to detect, investigate, contain, and remediate security events.
• If a personal-data breach affecting you occurs, we will notify affected customers and, where required, regulators, within the timeframes and in the manner required by applicable law, and will provide information to help you meet your own obligations.

15. Responsible Disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in Graypie:

• Email security@graypie.com with details and steps to reproduce.
• Please give us a reasonable time to investigate and remediate before any public disclosure, and avoid accessing, modifying, or deleting data that is not yours.
• Do not run tests that could degrade the Service or affect other customers.

Acting in good faith under this policy, we will not pursue legal action for your research.

16. Compliance

We design our controls with recognized industry frameworks and applicable data-protection laws (such as the GDPR/UK GDPR and relevant local regulations) in mind, and we continually evaluate our practices as the Service grows.

17. Shared Responsibility

Security is a partnership. Graypie secures the platform; you help secure your account by:

• using strong, unique passwords and enabling two-factor authentication;
• managing team members' roles and permissions on a least-privilege basis and promptly removing access for people who leave;
• reviewing and revoking trusted devices when appropriate;
• keeping your own devices, networks, and email secure; and
• reporting anything suspicious to security@graypie.com.

18. Contact

Security questions, concerns, or vulnerability reports:

Email: security@graypie.com Web: https://graypie.com For privacy-specific matters: privacy@graypie.com