← graften.io
Summary: Graften is a B2B security and compliance platform. We collect business and technical data to provide our service. Your data is encrypted at rest and stored in Australia (AWS ap-southeast-2, Sydney); credentials and secrets are also encrypted with a key unique to your account. We do not sell your data. We do not serve advertising.
1. Who we are
Graften ("Graften", "we", "us", "our") is a security and compliance platform for managed service providers and organisations. The platform is operated by Graften Technologies Pty Ltd, an Australian company.
Contact: privacy@graften.io
2. Who this policy applies to
This policy applies to:
- Subscribers — businesses and individuals who create a Graften account
- Users — individuals who access Graften under a subscriber's account
- Clients — organisations whose security posture is managed through Graften by a subscriber (typically an MSP's end clients)
- Visitors — anyone who visits graften.io or docs.graften.io
If you are a client of an MSP using Graften, your MSP is the primary data controller for your organisation's data. Graften acts as a data processor (a sub-processor of your MSP) on their behalf.
3. Data we collect
3.1 Account data
| Data | Purpose | Basis |
|---|
| Name, email address, password (hashed) | Account creation and authentication | Contract |
| Company name, ABN/NZBN/Companies House number, country | Billing identity, invoicing, fraud prevention | Contract / Legal obligation |
| Website URL | Account type verification (MSP vs direct) | Legitimate interest |
| Payment method (tokenised) | Subscription billing via Stripe | Contract |
| MFA credentials (TOTP seed, encrypted) | Account security | Contract |
3.2 Client and security posture data
When you use Graften to manage client security, we store:
- Client organisation names, domains, and contact details you provide
- Cloud infrastructure data collected by InfraAudit (AWS, Microsoft 365 and Entra ID, Azure, Google Cloud) via read-only API credentials you provide, and data read from the other integrations you connect (for example RMM, PSA, endpoint protection, backup, accounting and HR systems)
- Endpoint data collected by the Graften on-premises agent on the Windows, macOS or Linux machine it is installed on (operating system version, patch status, firewall and encryption settings, installed software, local user accounts, open ports, security policy settings)
- Network and device data collected by the on-premises agent from devices it reaches, only if the subscriber configures it to: SNMP devices in the address ranges the subscriber sets, and hypervisors, storage systems and security appliances the subscriber names. It uploads device names and network addresses, operating system and firmware versions, security and configuration settings, and what it could not collect and why. It never contacts addresses on the subscriber's exclusion list, and a device's own error pages are never uploaded
- Network and device data collected by the Graften site appliance, a virtual machine a subscriber runs on a client's network. Each collector runs only if the subscriber sets it up, and it contacts only the address ranges the subscriber approves. It uploads device names and network addresses, operating system and firmware versions, security settings, counts (for example, how many privileged accounts exist, not their names), the text a device presents about itself (such as its SNMP description or SSH banner), and backup and update status. It does not upload raw device output, log message contents, or file contents
- Vulnerability findings, risk register entries, compliance assessments, and remediation records you create
- Dark web breach findings retrieved from the Have I Been Pwned (HIBP) API for domains you register: the email addresses of client staff found in known breaches, with the breach name and date
- Phishing simulation recipients' names and email addresses, and whether and when they opened or clicked, with IP address and browser user agent
- Per-person security risk scores for client staff (phishing click rate, MFA enrolment, training completion)
- Employee names, work email addresses, job titles and start and end dates read from HR systems you connect, and onboarding and offboarding records
- Client portal users' names, email addresses and hashed passwords
- Security news and threat intelligence from ACSC, CISA, and NVD
3.3 Usage data
- Audit log entries (who did what, when) for your account
- API request logs (retained 30 days)
- Error logs (retained 14 days)
3.4 Data we do NOT collect
- We do not collect or store the contents of client emails, documents, or files
- We do not collect browser tracking cookies or third-party advertising data
- We do not collect biometric data
- We cannot read the passwords or tokens a subscriber gives the site appliance to read client devices. Entered at the appliance's console, they never leave it. Entered in the Graften portal, they are encrypted in the subscriber's browser to that appliance's own key before they are sent; we store and pass on only that encrypted form and do not hold the key to open it
- We do not collect the device passwords a subscriber puts in the on-premises agent's configuration. They stay in that configuration on the machine, readable by its administrators only, and are never sent to Graften
4. How we use your data
| Use | Basis |
|---|
| Providing the Graften platform and its features | Contract |
| Processing subscription payments | Contract |
| Sending transactional emails (account creation, invoices, alerts) | Contract |
| Generating AI-assisted reports and vCISO outputs using Anthropic's API | Contract / Legitimate interest |
| Verifying business numbers against ABR, NZBN, Companies House, and ACRA | Contract / Legitimate interest |
| Dark web monitoring via the HIBP API for domains you register | Contract |
| Platform security, fraud prevention, and abuse detection | Legitimate interest |
| Improving the platform (aggregated, anonymised analytics only) | Legitimate interest |
| Compliance with legal obligations | Legal obligation |
5. AI features and data processing
Graften uses Anthropic's Claude API to power the vCISO chat, report generation, and AI-assisted analysis features. When you use these features:
- Relevant context (compliance scores, risk findings, framework data) is sent to Anthropic's API to generate responses
- Anthropic processes this data under its commercial API terms: it does not use API inputs or outputs to train its models, and keeps them only for a limited period, for example to detect misuse
- AI features other than the in-app support assistant are an add-on and are off unless your account has it
What is sent can include client organisation names, risk owner names, questionnaire text you upload, audit findings, and anything you type into a chat. Audit findings can name a specific account where the finding is about it. We do not send dark web results or phishing simulation results to the AI.
6. Signing in with Google or Microsoft
Graften offers "Sign in with Google" and "Sign in with Microsoft" as optional ways to create or access your account. They work the same way; for Google:
- What we access: With your consent via Google's OAuth screen, we receive your name, email address, and profile picture from your Google Account (we do not store the picture). We request only the
openid, email, and profile scopes — we do not request access to your Gmail, Google Drive, Google Calendar, or any other Google service or data.
- How we use it: This information is used solely to create your Graften account, authenticate you on sign-in, and pre-fill your name and email on the signup form. It is not used for any other purpose.
- Sharing: Data received from Google is not shared with any third party, sold, or used for advertising. It is stored under the same protections described in Section 7 (Data storage and security) as the rest of your account data.
- Retention and deletion: Data received from Google is retained for as long as your Graften account is active, per the retention schedule in Section 9 (Data retention), and is deleted on the same terms as the rest of your account data. You can request deletion at any time by emailing privacy@graften.io, and you can revoke Graften's access to your Google Account at any time from your Google Account permissions page.
Graften's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to serve advertising, and we do not use it to train generalised AI/ML models.
7. Data storage and security
- Location: All subscriber data is stored in AWS ap-southeast-2 (Sydney).
- Encryption at rest: All data is encrypted at rest by AWS (database storage and S3, using AWS KMS). Credentials, access tokens, secrets and generated reports are also encrypted with AES-256-GCM using a data key unique to each subscriber account, wrapped by AWS KMS. Graften staff access subscriber data only where needed for support and operations; that access is restricted and logged.
- Encryption in transit: All data is transmitted over TLS 1.2 or higher. TLS 1.0 and 1.1 are disabled.
- Access control: Subscriber data is logically isolated. Database queries are scoped to the authenticated subscriber's ID at the application layer.
- Backups: Aurora PostgreSQL automated backups, kept for 35 days and encrypted. Earlier versions of stored files are kept for up to 365 days.
- Site appliance: its only connections to Graften are outbound, over TLS, and every upload is signed. On the client network it contacts only the address ranges the subscriber approves, never addresses on the exclusion list, and accepts only syslog (port 514) from those ranges; discovery and exposure scans run only if the subscriber turns them on. Device passwords entered in the portal are encrypted in the subscriber's browser to the appliance's own key, and Graften stores and forwards only that encrypted form, which it cannot open. On the appliance they are stored encrypted; anyone with a full copy of its virtual disk could recover them. It installs only software releases signed by Graften, and only inside the maintenance window the subscriber sets; a release marked critical installs at the next window once it has been available for the subscriber's set number of days (default 14).
- On-premises agent: its only connections to Graften are outbound, over TLS; it also contacts the devices the subscriber configures it to read. It installs only software releases signed by Graften, inside the update window if the subscriber sets one, and puts the previous version back if a new one does not report.
8. Who we share data with
| Third party | Purpose | Data shared |
|---|
| Amazon Web Services | Cloud infrastructure, database, storage, KMS, email delivery (Amazon SES) | All platform data (encrypted), email addresses and email content |
| Anthropic | AI-assisted features | Content of AI requests (see section 5) |
| Stripe | Payment processing | Billing details, payment method |
| Have I Been Pwned | Dark web monitoring | Domain names you register for monitoring |
| Australian Business Register | ABN validation at signup | ABN number only |
| New Zealand Companies Office | NZBN validation at signup | NZBN number only |
| Companies House (UK) | Company number validation at signup | Company number only |
| ACRA (Singapore), via data.gov.sg | UEN validation at signup | UEN number only |
| Google and Microsoft | Sign-in, if you choose it | Sign-in request; we receive name and email |
| Google Fonts | Web fonts in the portal and shared pages | Your browser's IP address and user agent |
| Microsoft and AWS Marketplace | Subscriptions bought through a marketplace | Subscription and billing identifiers |
When you connect an integration (PSA, RMM, accounting, HR, chat or webhook tools), we send it the data that integration needs, at your direction; those providers act under your own agreement with them.
We do not sell personal data to third parties. We do not share data with advertisers.
9. Data retention
| Data type | Retention period |
|---|
| Account and subscriber data | Duration of subscription + 90 days after cancellation |
| Security posture data | Duration of subscription + 90 days |
| Graften's audit trail of account activity, and marketplace billing records | Kept after account deletion for security and legal purposes; the account record is anonymised |
| Generated report files | Until deleted or the account is deleted; earlier versions up to 365 days |
| Invoices and payment records | 7 years, held by Stripe and in our accounting records (legal obligation) |
| API request logs | 30 days |
| Error logs | 14 days |
| Database backups | 35 days rolling; deleted data leaves backups within 35 days |
On account cancellation, you may request deletion of your data sooner, completed within 30 days, by emailing privacy@graften.io. Billing records are retained as required by law.
10. Your rights
Depending on your jurisdiction, you may have the right to:
- Access — request a copy of the personal data we hold about you
- Correction — request correction of inaccurate data
- Deletion — request deletion of your data (subject to legal retention requirements)
- Portability — request your data in a machine-readable format
- Objection — object to processing based on legitimate interest
- Restriction — request restriction of processing in certain circumstances
To exercise any of these rights, email privacy@graften.io. We will respond within 30 days. For Australian users, you also have the right to make a complaint to the Office of the Australian Information Commissioner (OAIC).
11. Cookies and tracking
Graften uses only technically necessary cookies — specifically a session cookie for authentication purposes. We do not use advertising cookies, analytics cookies, or any third-party tracking. There is no cookie banner on graften.io because we do not set non-essential cookies.
12. Children's data
Graften is a B2B platform intended for business use. We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have inadvertently collected such data, contact us at privacy@graften.io.
13. International data transfers
Graften's primary data store is in AWS ap-southeast-2 (Sydney, Australia). If you are located outside Australia, your data may be transferred to and stored in Australia. Some data is also disclosed to service providers in the United States: Anthropic (AI features) and Stripe (billing). For UK/EU subscribers, we rely on standard contractual clauses for any data transfers outside the UK/EEA where applicable.
14. Changes to this policy
We will notify subscribers by email at least 14 days before making material changes to this policy. The current version is always available at graften.io/privacy.
15. Contact
Privacy questions, data requests, and complaints:
privacy@graften.io
Graften Technologies Pty Ltd, Australia