Trust

Trust and security

Agents that ask first, and are held to it in code: most tools that send or change something outside your workspace pause for the person who asked, and an agent credential cannot record a person's answer or approval. Read the exceptions

We do not yet have a SOC 2 report of our own, a penetration test, a data processing agreement, single sign-on, a public status page or a written incident response plan. Every model provider in your data's path is listed, with what it receives. See the sub-processors

Request the security packet Report a vulnerability

The packet is in review. Until it is approved, write to us and we answer your questions directly.

At a glance

Nothing here is shown as in place unless it is. The counts and answers are read from the same rows as the controls below, and every gap is counted.

39 in place3 inherited5 in progress8 planned4 not built

Procurement snapshot
Question	Answer	What it covers
A SOC 2 report of our own	No	We have not been audited; we rely on the attestations of our hosts.
A third-party penetration test	No
A data processing agreement	Not yet, planned	On every paid plan.
Single sign-on	Not yet, planned	SAML and OIDC. On every paid plan.
Two-factor sign-in	Yes	With an authenticator app, on every plan.
An audit log you can read	Yes	Owner and admins can read its audit log in Settings. Entries are kept 365 days.
Export and delete your workspace	Yes	The workspace owner can download the workspace's data as one archive. The workspace owner can delete the workspace.
Routed model requests kept out of training by default	Yes	A workspace admin can change this. The setting is sent to our model gateway, which applies it under its own terms.
Where your data lives	Yes	Railway in US West. Supabase in AWS us-west-2 (Oregon).
A public status page	Not yet, planned
A written incident response plan	Not yet, planned

Documents

Every document is listed with how you can get it. One that does not exist yet says so, with its tracker number, and is never a link.

Public
Vulnerability disclosure policy
Public
security.txt
Public
Sandbox assurance run (September 2026): our own test of nine boundaries, not a third-party test
Public
Privacy policy
Public
Cookie policy
Public
Terms of service
Not yet
Security packet (architecture, isolation and its tests, agent safety, secrets, change management) In review. Tracked as #2923. Until it is approved, write to us and we answer your questions directly.
Not yet
Questionnaire answers (CAIQ-Lite style) In review. Tracked as #2923.
Not yet
CSA STAR Level 1 self-assessment In review. Tracked as #2923.
Not yet
Data processing agreement Tracked as #2950.
Not yet
Incident response plan (summary) Tracked as #2949.
Not yet
SOC 2 report and penetration test report No plan yet.

What we do not have yet

We list these so you do not have to find them. Planned means we intend to build it and it is not available today; not built means there is no plan yet. This list is read from the same rows as the grid.

Planned
A public status page with uptime history. Tracked as #2948.
Planned
Agent and conversation run history has no retention window yet: nothing deletes it on a schedule, so it is kept until the workspace is deleted. Tracked as #3011.
Planned
A backup restore that we have tested. Tracked as #2951.
Planned
Automated dependency vulnerability scanning. Tracked as #2952.
Planned
Single sign-on (SAML and OIDC), on every paid plan. Tracked as #2927.
Not built
Restricted and logged staff access to customer data. Not built, and no plan yet.
Not built
Continuous integration and branch protection. Not built, and no plan yet.
Planned
A written incident response plan and a breach-notification commitment. Tracked as #2949.
Not built
A SOC 2 report of our own. We have not been audited; we rely on the attestations of our hosts. Not built, and no plan yet.
Not built
A third-party penetration test. Not built, and no plan yet.
Planned
A data processing agreement, on every paid plan. Tracked as #2950.
Planned
Sub-processor changes announced in a dated update log. Tracked as #2923.

AI and agent trust

Gridable is a place where agents do work, so this is where the limits matter most. What an agent can reach, what it asks about first, and what is recorded. These are policies on a model-driven system: they reduce risk; they are not a proof.

In place
By default, requests that go through our model gateway go only to providers that do not retain or train on them. A workspace admin can change this, and the change is recorded. The setting is sent to our model gateway, which applies it under its own terms. It does not reach models Gridable calls directly.
Inherited
Claude and OpenAI models called directly run under API terms that do not train on API data by default; each provider keeps that data for a limited period under those terms. Calls made directly to Google's Gemini API (voice transcription, image generation and search indexes) are not covered by this row, and we make no training claim for them.
Source: platform.claude.com/docs/en/manage-claude/api-and-data-retention developers.openai.com/api/docs/guides/your-data
In place
Most tools that send or change something outside your workspace pause for the person who asked. Sends inside a standing send-as-me grant that person gave go without a per-send approval, and a few older tools are not yet gated. An approval given in one run answers no other run.
In place
When a run itself takes in text nobody in your workspace wrote, such as an attachment or a fetched page, tools that send or change things outside your workspace are refused for that run. Reading a page or searching stays available. In a later message in the same conversation, those tools pause instead for the person who asked, showing the tool and its whole request (one too long to show in full is refused), and are refused when nobody is watching.
In place
After outside content, a web request that sends data (any method but GET, or with a body) is refused, and an address the agent composed itself is asked about while a person is present and refused when none is. Search text is not covered by this check.
In place
An agent credential cannot record a person's answer or approval, or loosen a safety setting: those routes refuse it. It can still start workflows and agent runs and use some publishing routes.
In place
An agent can only propose a change to a coworker's role or permissions; a person approves the exact change.
In place
An admin can read recent entries of the workspace's record of administrative actions, and export the text-message consent record. Agent approvals are not exported yet, and a screen for the full record is planned.
In place
A hired agent uses only the connections an admin gave it, read or read and write, enforced on the server, including when it hands work to another coworker or rewires a live workflow. Its limits today: the list covers connections, not apps; agents that existed before this shipped hold an explicit every-connection grant that an admin can review and revoke; and an agent whose write starts a person's own automation is still being closed. Limits tracked as #2977.
In progress
A second model reviewing each tool call before it runs is built and tested. It is off by default and is not relied on here.
In place
The approval cards Gridable raises at a tool gate lead with the consequence, then the exact thing, then why, and carry a risk word, except for some reads.

Controls

Grouped by area, each with a count of its statuses; open an area to read its rows. AI and agent controls have their own section above. Each control shows its status as a word, and one that comes from a vendor links the vendor's page. Policies on a model-driven system reduce risk; they are not a proof.

The controls we build are checked by automated tests that run before every release; the ones we inherit from our hosts link to their sources. We walk your security team through them on request, under NDA — write to security@gridable.ai.

Infrastructure5 in place1 inherited1 in progress1 planned

Inherited
Gridable is hosted on Railway; Railway names its own infrastructure providers on its trust center.
Source: trust.railway.com/
In place
Connections use HTTPS, and plain-HTTP requests are redirected.
In place
Agent runs execute in a separate worker process from the web server.
In place
Outbound requests from agents go through one guarded fetch that blocks internal addresses, and a worker refuses to start without it.
In place
Security headers are set on every response the Gridable server sends.
In progress
A Content Security Policy is built from each page and reported today; it is not yet enforced.
In place
Our application servers run on Railway in US West, and our database runs on Supabase in AWS us-west-2 (Oregon).
Planned
A public status page with uptime history. Tracked as #2948.

Data protection6 in place1 inherited2 in progress2 planned

Inherited
Data at rest is encrypted by our database host, as its shared responsibility model states.
Source: supabase.com/docs/guides/deployment/shared-responsibility-model
In place
A workspace cannot read another's records: the workspace comes from the verified session, every row carries it, and a test suite pins that for workflows, knowledge, chats, attachments and more.
In place
Tokens for connected tools are held by a self-hosted broker; Gridable keeps only an owner-sealed reference, usable only by the workspace that owns it.
In progress
Keys you give Gridable are sealed with AES-256-GCM; some older rows still need re-sealing. Tracked as #1199.
In place
Workflow run history, with the step records and notification log rows kept alongside it, is deleted after 90 days.
Planned
Agent and conversation run history has no retention window yet: nothing deletes it on a schedule, so it is kept until the workspace is deleted. Tracked as #3011.
In progress
Session summaries have no retention window yet: nothing deletes them on a schedule, so they are kept until the workspace is deleted. Tracked as #3000.
In place
Our main database is backed up daily by our host and each backup is kept 7 days; stored files are not in those backups. The sign-in service's database and our application's file volume are backed up daily (kept 6 days) and weekly (kept 27 days). Point-in-time recovery is not enabled on either.
Source: supabase.com/docs/guides/platform/backups
Planned
A backup restore that we have tested. Tracked as #2951.
In place
The workspace owner can download the workspace's data as one archive; connected accounts and keys are in it by name only.
In place
The workspace owner can delete the workspace: its connections are revoked, its stored files removed and every row deleted, and a record of the deletion is kept.

Application security4 in place1 planned

In place
Passwords are stored as bcrypt hashes (cost 12), must be at least 8 characters, and are checked against known breaches; only the first 5 characters of a hash leave Gridable for that check.
In place
Sign-up, sign-in and password reset are rate limited per address.
In place
Signing out is enforced by the server, and you can sign out everywhere.
In place
Secrets and personal data are scrubbed from server logs by one shared helper.
Planned
Automated dependency vulnerability scanning. Tracked as #2952.

Access and identity6 in place1 planned1 not built

In place
Owner, admin and member roles are decided from the stored account, never from a sign-in token.
In place
Security settings, such as the training policy and team changes, are admin-only and recorded.
In place
Security events are recorded: sign-ins and failed sign-ins (never the password typed), password changes and resets, accepted invitations, coworker edits, invites, removals, ownership transfer, tokens, grants and the training policy.
In place
On every plan, your workspace's owner and admins can read its audit log in Settings: who did what, to what, and when, filtered by action or person. Entries are kept 365 days, then deleted.
In place
Two-factor sign-in with an authenticator app, on every plan: a code after the password, each code accepted once, ten one-time recovery codes stored hashed, and the secret sealed at rest. Turning it on or off needs a recent sign-in and is recorded in the audit log.
In place
Our administrator accounts for code (GitHub), hosting and domains (Railway), database (Supabase), company email (Google Workspace) and payments (Stripe) use multi-factor authentication, as checked by the owner on 2026-09-30.
Planned
Single sign-on (SAML and OIDC), on every paid plan. Tracked as #2927.
Not built
Restricted and logged staff access to customer data. Not built, and no plan yet.

Change management2 in place1 not built

In place
Every change passes four automated gates: server tests, unit tests, dead-code and build.
In place
A security review of exactly what a release makes live runs before every promotion.
Not built
Continuous integration and branch protection. Not built, and no plan yet.

Incident response and disclosure2 in place1 planned2 not built

In place
A published disclosure policy with scope and safe harbour, and a security.txt that points to it.
In place
We acknowledge a vulnerability report within 3 business days.
Planned
A written incident response plan and a breach-notification commitment. Tracked as #2949.
Not built
A SOC 2 report of our own. We have not been audited; we rely on the attestations of our hosts. Not built, and no plan yet.
Not built
A third-party penetration test. Not built, and no plan yet.

Privacy3 in place1 planned

In place
A privacy policy whose every claim is pinned to code.
In place
A cookies notice.
Planned
A data processing agreement, on every paid plan. Tracked as #2950.
In place
A privacy contact.

Vendor management2 in place1 in progress1 planned

In place
Every outside service that receives customer data is listed, with what it receives.
In progress
One listed service still lacks a detail: where the database behind our connection broker runs. Tracked as #2923.
In place
Each host's own attestation is linked from the page about that host.
Source: trust.railway.com/ supabase.com/security trust.openrouter.ai/
Planned
Sub-processor changes announced in a dated update log. Tracked as #2923.

How Gridable is built

This is the path your data takes, in order. It names only what the code does.

Your browser reaches Gridable over HTTPS. Our host, Railway, terminates the encrypted connection and Gridable redirects plain HTTP to HTTPS.
The Gridable server runs on Railway and starts a separate worker process for agent runs.
Accounts, workspaces, conversations, workflows and stored files live in a Supabase database and storage.
Isolation between workspaces is enforced by the application: every row carries a workspace identifier, the server takes the workspace from your verified session, and the database's public API roles are closed off. It is not a separate database per workspace.
When you connect a tool such as QuickBooks, Shopify or Google, its tokens are held by a self-hosted connection broker (Nango). Gridable's database keeps only an owner-sealed reference, never the token.
People who sign in to a published app do so through a self-hosted sign-in service (Logto).
Prompts and tool results go to the model providers Gridable routes to: Anthropic, OpenAI, Google and OpenRouter. Some calls go straight to Google's Gemini API; we make no training claim for those.
Audio goes to Deepgram and image requests to fal, only when you use voice or image features.
Email goes through SendGrid, text messages and calls through Twilio, and payments through Stripe.

Sub-processors

Every outside service that receives customer data, what it receives and when, is listed once. This list and the privacy policy read the same source.

Each row is pinned to the code that sends the data. The privacy policy carries the same rows. We state a region only where we have confirmed it, so where none is shown, none is claimed.

26 services: 6 always, 5 only if you connect them, 15 only when you use the feature they serve.

Sub-processors
Service	Domain	What it receives	When
Always, for every workspace (6)
RailwayRegion: US West	railway.app	Hosts the Gridable server. Everything you send to Gridable passes through it, and it terminates the encrypted connection.	Always
SupabaseRegion: us-west-2 (AWS Oregon)	supabase.com	The database and file storage: your account, workspace records, conversations, workflows and uploaded files.	Always
SendGrid	sendgrid.com	Sends Gridable email (password resets, invitations, workflow notifications and support messages): the recipient address and the message.	Always
Pwned Passwords	api.pwnedpasswords.com	When you set a password: the first 5 characters of its SHA-1 hash, never the password, to check it against known breaches.	Always
OpenRouter	openrouter.ai	Requests answered by models from other makers (DeepSeek, Moonshot AI's Kimi, Z.ai's GLM, StepFun and OpenAI models), and Gridable's housekeeping summaries (run by Fireworks, Together or DeepInfra).	Always
Model hosts behind OpenRouter (Fireworks, Together, DeepInfra and others)	Not listed	Run the models OpenRouter routes to. Gridable's housekeeping summaries of your conversations always go to Fireworks, Together or DeepInfra, which OpenRouter lists as zero-data-retention hosts for that model (read 2026-09-29). Other requests go to the host OpenRouter picks, and by default only hosts that do not store or train on prompts are used.	Always
Only if you connect it (5)
Nango	nango.gridable.store	The connection broker: open-source software, and Gridable runs it itself on Railway (listed above). When you connect an app such as QuickBooks, Google or Shopify, it holds that connection's tokens and relays requests to it, so it carries the data they read and write.	Only if you connect it
Intuit QuickBooks	intuit.com	When you connect QuickBooks: your workflows read your company's records and create invoices in it.	Only if you connect it
Shopify	myshopify.com	When you connect a Shopify store: your workflows read and update its products, inventory and orders.	Only if you connect it
Google Workspace	googleapis.com	When you connect a Google account: the Sheets, Drive files, Gmail messages and Calendar events your workflows read or write.	Only if you connect it
Telegram	api.telegram.org	When you connect a Telegram bot: the messages sent to and from your workspace's bot.	Only if you connect it
Only when you use the feature it serves (15)
Stripe	stripe.com	Takes payment when you buy a plan: your email address and your account and workspace IDs. Card details go to Stripe directly and never reach Gridable.	Only when used: buying a plan
GitHub	github.com	Holds support requests sent from inside the console: your name, email, account and workspace IDs and your message, as an issue in Gridable's tracker.	Only when used: sending a support request
Twilio	twilio.com	Text messages (workflow SMS steps and invitations to a published app) and calls to a Gridable voice line: the phone number, the message and the call.	Only when used: text messages and the voice line
Logto	Not listed	The sign-in service for published apps: open-source software, and Gridable runs it itself on Railway (listed above). When an app turns on sign-in, the people using it sign in through Logto, which tells Gridable their email address.	Only when used: sign-in for a published app
Web search (Brave, Serper, Bing, DuckDuckGo)	search.brave.com,serper.dev,bing.com,duckduckgo.com	When an agent searches the web: the search words.	Only when used: an agent searching the web
Firecrawl	firecrawl.dev	When a workflow reads a web page through Firecrawl: the page address and what to read from it.	Only when used: reading a web page through Firecrawl
Weather (Open-Meteo, OpenWeatherMap)	open-meteo.com,openweathermap.org	When an agent looks up the weather: the place name.	Only when used: an agent looking up the weather
OpenFreeMap	tiles.openfreemap.org	Maps in published apps: the viewer's IP address and which map area is shown (see Maps and Location above).	Only when used: a map in a published app
Anthropic	anthropic.com	Requests, conversations and workflow steps answered by a Claude model.	Only when used: a Claude model answering
OpenAI	openai.com	Requests answered by an OpenAI model, image requests, and text for search indexes.	Only when used: an OpenAI model, image generation or a search index
Google Gemini	generativelanguage.googleapis.com	Requests answered by a Gemini model, voice audio to transcribe, image requests, and text for search indexes.	Only when used: a Gemini model, voice transcription, image generation or a search index
Typesafe (Jev decision model)	Not listed	Judges a tool call or a coworker decision through OpenRouter: the task text, the call's arguments and, for a coworker decision, workspace content. Every request asks for zero data retention.	Only when used: the tool judge and coworker decisions
Deepgram	deepgram.com	Voice features: audio to transcribe and replies to speak.	Only when used: voice
fal	fal.run	Image generation requests.	Only when used: image generation
Google Stitch	Not listed	When an agent designs a screen with the design tool: the design topic, the details and style the agent writes, and an optional reference it names.	Only when used: the design tool

What we inherit from our hosts

These are our hosts' own attestations, not ours. Each link goes to the vendor's page; we claim nothing beyond what that page says, and who can obtain a report depends on the vendor's plan.

Railway (hosting): SOC 2 Type II. Railway trust center
Supabase (database and storage): SOC 2 Type II. Supabase security
OpenRouter (model gateway): SOC 2 Type II. OpenRouter trust center
The connection broker and the app sign-in service are self-hosted, so no vendor attestation transfers to them.

Status and uptime

Whether Gridable is up right now, and its history.

We do not run a public status page yet. One is planned, tracked as #2948.

What changed in security

Dated entries, newest first.

2026-09-30 Control added. An agent that had read outside content, or a follow-up run in the same conversation, can no longer change a workflow that is switched on unless a person approves or makes the change. Tracked as #2989.
2026-09-30 Control added. Two-factor sign-in with an authenticator app can be turned on in Settings, on every plan. Tracked as #2926.
2026-09-30 Control added. Sign-ins, failed sign-ins, password changes and coworker edits are recorded, and a workspace's owner and admins can read the audit log in Settings. Entries are kept 365 days. Tracked as #2925.
2026-09-30 Control added. A workspace's owner can download the workspace's data as one archive, and can delete the workspace once its plan is cancelled. Deleting needs the workspace name typed and a recent sign-in. Tracked as #2924.
2026-09-30 Control added. When an agent needs a connection it does not hold, the run pauses on a card that asks a person: allow once, allow always (admins only), or do not allow. Tracked as #2931.
2026-09-30 Fix. A person who follows a card link now reads the card's conversation read-only, instead of opening a room of their own. Tracked as #2959.
2026-09-30 Control added. A coworker's access list now holds through a chain of hand-offs, and when a workflow's edges are rewired. Tracked as #2971.
2026-09-30 Copy corrected. Six claims in the AI and agent section were narrowed to what the code does. Tracked as #2923.
2026-09-30 Control added. Who pays for a Troubleshoot diagnosis is decided by a record the platform wrote, and Gridable's share of them is capped per workspace per day. Tracked as #2970.
2026-09-29 Control added. An agent can only propose a change to a coworker's role or permissions; a person approves the exact change. Tracked as #2934.

Questions we are asked

Each answer ends with the section that shows its evidence.

Do you have SOC 2?
No. Gridable has not been audited. Our hosts hold attestations of their own, which are theirs and not ours. See What we inherit from our hosts
Is my data used to train AI models?
Not by default for requests through our model gateway: they go only to providers that do not retain or train on them, and a workspace admin can change that, which is recorded. Claude and OpenAI models we call directly run under API terms that do not train on API data by default, and those providers keep it for a limited period. We make no training claim for calls made directly to Google's Gemini API. See AI and agent trust
Can one workspace see another's data?
No. The workspace comes from your verified session and every row carries it. The limit: isolation is enforced by the application, and each workspace does not have a database of its own. See How Gridable is built
Can an agent act without me?
Most tools that send or change something outside your workspace pause for the person who asked, and an approval answers only that run. Sends inside a standing send-as-me grant go without a per-send approval, and a few older tools are not yet gated. See AI and agent trust
What can an agent access?
Only the connections an admin gave it, and a chain of hand-offs is held to the same list. Agents that existed before this shipped hold an explicit every-connection grant, which an admin can review and revoke. One road is still being closed: an agent's write that starts a person's armed automation, tracked as #2977. See AI and agent trust
Do you support SSO and 2FA?
Two-factor sign-in with an authenticator app is available on every plan. Single sign-on is not yet available; it is planned for every paid plan, tracked as #2927. See Controls
Can I export or delete my data?
Yes. The workspace owner can download the workspace's data as one archive at any time, and can delete the workspace once its plan is cancelled. Deleting needs the workspace name typed and a recent sign-in. See Controls
How do I report a vulnerability?
Write to security@gridable.ai or use the form on this page. We treat you as a colleague, and research within the policy is authorised. See Report a vulnerability
Do you sign a DPA?
Not yet. A data processing agreement is planned for every paid plan, tracked as #2950. See Documents
How are my connected-app credentials stored?
A self-hosted connection broker holds the tokens. Gridable keeps only an owner-sealed reference, usable only by the workspace that owns it. See How Gridable is built
What happens during an incident?
There is no written incident response plan yet; it is planned, tracked as #2949. We do not state a notification window until that plan exists. See What we do not have yet
Is there a status page?
Not yet. A public status page is planned, tracked as #2948. See Status and uptime

Report a vulnerability

If you believe you have found a security problem in Gridable, tell us. We will treat you as a colleague.

Email security@gridable.ai with what you found and how to reproduce it.
Or use the form below. It keeps your report, passes it to our team as text we treat as data and never as instructions, and gives you a reference number. If the form is not available it says so, and email always works.
You can also report through HackerOne's report form for our vulnerability disclosure programme. It carries HackerOne's Gold Standard Safe Harbor. Our own form and email above are the primary way to reach us.
We acknowledge a vulnerability report within 3 business days. We tell you when it is fixed.
In scope: getgridable.com, gridable.ai and the Gridable API. Out of scope: denial of service, social engineering, physical attacks, and the systems of our vendors (report those to the vendor).
Please test only against your own workspace, stop once you have shown the problem, do not read or change anyone else's data, and give us reasonable time to fix before you share details.
Safe harbour: research within this policy, done in good faith, is authorised. We will not take legal action against you for it.
We do not run a paid bounty programme.
This policy is also published as security.txt.

Loading the report form.

Report through HackerOne instead, if you would rather use their form.

Contact and the security packet

Procurement questions, a questionnaire to answer, or a report to make.

Security and procurement: security@gridable.ai
Privacy: privacy@gridable.ai

Gridable is operated by TeamStrength LLC, an Arizona limited liability company, PO Box 408, Florence, AZ 85132, United States.

Ask about the security packet

The packet is in review. Until it is approved, write to us and we answer your questions directly.

To keep a copy, print this page and choose Save as PDF. The printed copy has every area open.