Know where your records are kept.
Grace keeps each customer's records separate. This page explains what works today and what is still planned.
Our position
Uploaded files use private storage and short-lived download links. Each file row is tied to its owner. Storage connectors and customer-held keys are planned, not active today.
Free & Starter — metadata-first
Free tier stores no files at all. Starter and Pro use an in-app evidence vault scoped per user, with row-level security and per-file signed download URLs.
Pro — in-app vault
Encrypted at rest. Signed URLs for downloads. Files are scoped to your account; cross-tenant access is blocked at the database level.
Business storage options
Regional storage and customer-managed keys need separate setup and are not active in the current app.
Customer storage connections
Connections to customer storage are planned. The current app stores paid-plan uploads in its private file store.
Platform security today
- All traffic over HTTPS. Authentication tokens are short-lived and rotated.
- Database access is gated by row-level security; every record carries an owner ID and is queryable only by that owner.
- Evidence storage is a private bucket — no public URLs. Downloads require a signed URL that expires.
- Password reset, email confirmation, and OAuth flows go through managed identity infrastructure with industry-standard hashing.
Roadmap commitments
- SOC 2 Type I — target Q1 2027.
- SOC 2 Type II — follows Type I.
- Published sub-processor list and EU residency disclosure — Release 2.
- BYO-storage connectors for S3, Snowflake, SharePoint — Release 2 with the high-risk module.
Grace is not currently SOC 2 or ISO 27001 certified. This page describes product settings, not an outside audit.