Your clients' security,
finally under control

It depends on the size of the client environment. After the first audit, scheduled audits run automatically.

Audits need read-only access only. For AWS, a cross-account read-only IAM role in the client's account (role ARN plus an optional external ID). For Microsoft 365, an Entra ID app registration with read-only Microsoft Graph application permissions, which the setup guide lists. Credentials are encrypted at rest using per-subscriber keys. If a permission is missing, the affected checks say they could not be collected rather than passing. Optional actions, such as offboarding automation, need write permissions you grant separately.

Yes for storage: Graften's database and files are in AWS ap-southeast-2 (Sydney). AI-assisted features (vCISO reports and chat) send the relevant content to Anthropic's API in the United States, and payments use Stripe in the United States. Email is sent through Amazon SES in Sydney. All sub-processors and their locations are listed in our DPA.

A penetration test is a point-in-time assessment. Graften re-checks your clients' cloud configuration on a schedule, flags changes in posture, and keeps an ongoing compliance record. Penetration tests are still valuable and Graften doesn't replace them, but it shows you when posture changes between tests.

Yes, on the Enterprise plan: client-facing reports and the client portal can carry your logo, company name and colours.

Sign up, connect your first client's cloud (AWS or M365) or deploy the on-premises agent, then run an audit. No credit card required. You see measured findings, an Essential Eight posture score with its coverage, and which controls are not assessed yet. At the end of 14 days, choose a plan or your account pauses; we keep your data for 90 days, then permanently delete it.