Security at Griddy
How we protect your data — from encryption and access controls to retention controls and privacy safeguards.
Encryption in transit & at rest
TLS 1.2+ at the edge. Datastores encrypted at rest in AWS-managed services.
No AI model training
We do not use customer content to train models without explicit opt-in.
Retention controls
Standard mode: interaction content up to 30 days and metadata up to 90 days. Privacy mode: metadata-only logs.
Secure authentication
Strong password rules and optional 2FA for accounts.
PII filtering in logs
Error monitoring is configured to limit sensitive data collection.
Infrastructure & payments
Hosted on AWS. Payments are processed by Stripe — we never store card numbers.
Privacy & data rights
Privacy commitments
- ✓Consent-based analytics with opt-in/opt-out controls
- ✓We do not sell or share personal information for advertising
- ✓Sub-processor list published in our Privacy Policy
- ✓Data Processing Addendum (DPA) available for Teams
- ✓Account-level Privacy mode and team-level enforcement controls
- ✓We notify users of material privacy policy changes
Data rights support
- ✓Access, correction, and deletion requests via support
- ✓Account deletion on request
- ✓Breach notifications in line with applicable law
Data handling
| Category | Details |
|---|---|
| What we store | Account data, billing identifiers, saved web-app spreadsheets, interaction logs (in Standard mode), and operational usage metadata |
| What we don't store | Payment card numbers (handled by Stripe) or long-term AI response content |
| Interaction content retention | Standard mode: up to 30 days for prompts, tool inputs/outputs, and model responses; then deleted. |
| Operational metadata retention | Up to 90 days for timestamps, tool names, status, latency, token/cost usage, and error codes; then deleted or anonymized. |
| Account data retention | Deleted on request, with limited records retained for abuse prevention |
| Payment records | Payments are processed by Stripe; we retain billing metadata as required for accounting |
| Sub-processors | Full list with purposes and locations available in our Privacy Policy |
Legal documents
Need a security review?
We're happy to walk through our security practices, fill out your security questionnaire, or discuss a custom DPA for your organization.
Contact Security