Your data, and what we do with it

Can anyone else see your data?

No. Your products, your components, your uploaded documents and everything written about them belong to your organization alone, and nothing in the product will show them to another customer. That separation is enforced by the software on every request rather than being a matter of care, and it is checked continuously by an automated test suite that treats a failure as a security defect rather than a bug.

The regulatory material itself — what the FDA, MHRA and the rest publish — is shared, because it is the same text for everybody. What is yours is what you told us and what we wrote for you.

Is your data used to train AI models?

No. We use Anthropic's Claude models to write the analysis, and Anthropic's commercial terms state that what is sent through their API is not used to train their models. We have no arrangement with anyone that would allow your documents, your product portfolio or anything you write in the product to be used to train anything.

It is worth knowing how little of your data is involved in the first place. The assessment of each regulatory item is written once and read by every subscriber, so it is produced from published material and carries nothing of yours at all. Only the parts written specifically for you — your impact assessment, your document findings, your daily briefing — include your product names, your profile or extracts from your documents.

What happens to a document you upload

We read it, and that is all. GrapeBeaver never edits, versions or rewrites a document you upload, and it is not the system your team works from — your quality system stays where it is, under your own change control, owned by whoever owns it today.

When an advisory bears on something you have written, you get a finding that cites the section and says what a reviewer should consider. It is a prompt to look, not a change to accept, and the product is deliberately built so that it cannot tell you that you are compliant or that you are not. That judgment is yours to make.

Uploaded files are never reachable by a public link. Every download goes through a check that the person asking belongs to the organization that owns the file.

What we hold

Two kinds, and the difference decides who you exercise a right against.

Held on your instructions

• · Documents you upload — Typically published standards, your own policies, and the product documentation you would give your own customers — plus any personal data those happen to carry, a named owner or approver most commonly. Reference copies for the agents to read against: the platform reads them, never edits them, and is not the system your teams work from.
• · Product records — Your device portfolio, software bill of materials, and the component inventory derived from it.
• · Organization profile — What you tell us about your markets, standards, operating functions and risk framework so that analysis can be written for you.

Held to run the service

• · Account — Email address, name, job title, time zone and display preference, password (stored only as an Argon2 hash), the date you joined and when you were last seen.
• · Organization — Organization name, plan tier, seat allocations, team membership and role, and invitations you send or receive.
• · Billing — Plan, subscription status and the Stripe customer reference. Card details are held by Stripe and never by us.
• · Usage — Which advisories you have read, the decisions your organization records against them, and a log of outbound email and model calls made on your behalf.
• · Support — Anything you send us through the feedback form or by email.

The regulatory and vulnerability material the platform reads is published by regulators and standards bodies. It is the same text for every reader, carries nothing of yours, and is not held on anybody's behalf. No protected health information — GrapeBeaver does not process it and no part of the product asks for it.

Who else receives it

Running the service means other companies are involved — somebody has to host the database, take the payment and deliver the email. Every one of them is named here, with what they receive and why. This is the same list as Annex III of the data processing agreement.

• · Anthropic, PBC (United States) — Generates the written analysis. Receives the text of published regulatory material, and — for per-organization output only — your device and component names, your organization profile, and extracts of the documents you upload. The shared analysis of a regulatory item carries no customer data at all: it is written once and read by every subscriber, so one customer's information cannot appear in it.
• · Stripe, Inc. (United States) — Payment processing and subscription billing. Receives your billing contact and payment details directly — card numbers are entered on Stripe's own hosted pages and never reach our servers.
• · Render Services, Inc. (United States (Oregon)) — Hosting, application database and backups. Holds all account data and all customer content at rest.
• · Amazon Web Services, Inc. (United States (Ohio, us-east-2)) — Stores the documents you upload and the source files retrieved from publishers. Objects are reachable only through views that check the organization. The bucket is private and carries no public ACL, so a stored document has no URL that works without a session.
• · ActiveCampaign, LLC (Postmark) (United States) — Delivers digests, briefings, alerts, invitations and password resets. Receives recipient addresses and message content.

We do not sell your data, and there is no advertising, profiling or data-broker relationship of any kind. All processing takes place in the United States.

Crash reports

When something breaks, an automatic report goes to Sentry, an error-tracking service, so a person finds out rather than it sitting in a log nobody reads. A crash report is a snapshot of the program at the moment it failed — and this program is often holding a document you uploaded when that happens.

So those reports are configured to leave out the contents of your documents, the text we send to the model, anything you submitted in the request, and who you are. It makes some problems harder for us to diagnose. That is the right trade for a product whose whole argument is that your words stay yours.

Keeping your account safe

• · Everything you send to us and everything we send back is encrypted in transit, always — there is no unencrypted way to reach the product.
• · Your data is encrypted where it is stored, including in backups.
• · We never store your password. What we keep cannot be turned back into it, and nobody here can look it up or tell you what it is.
• · Repeated sign-in attempts are throttled, and sessions expire so a forgotten open tab does not stay signed in indefinitely.
• · API keys are shown once when you create them and cannot be retrieved afterwards — only revoked and replaced.
• · The database is backed up daily, with point-in-time recovery.

Two-factor authentication and single sign-on are not available yet. They are the most requested items on our roadmap, and if either is a requirement for you it is worth telling us — it moves them up.

Nothing follows you around

There are no analytics scripts, no trackers, no advertising pixels and no third-party code of any kind on these pages. Even the typefaces are served from our own servers rather than a font network, so visiting this page does not tell anybody else that you did. The browser is prevented from loading third-party code at all, so this is enforced rather than promised — and you can confirm it in your browser's network tab in about ten seconds, which is more than can be said for most of the claims on a page like this.

A person reads it before you do

Every assessment is written with AI assistance and reviewed by a person before it reaches any subscriber. Nothing publishes itself on a timer, and every approval is recorded with who made it and when.

What you receive is decision support for your own regulatory judgment. It is not a compliance determination and does not replace one.

If something goes wrong

If your data is ever caught up in a breach, we will tell you within 72 hours of finding out, and sooner where we can. That is a commitment in the data processing agreement rather than an intention, and it applies to every customer automatically. We will tell you what we know while we are still working it out, because a partial answer inside the window is worth more to you than a complete one after it.

Security problems can be reported to security@grapebeaver.io. We will acknowledge within two business days and we will not take legal action against good-faith research.

Taking your data out, or deleting it

Your data is yours to leave with. A copy of everything we hold for you, in a portable format, can be requested at any time on any plan and we will provide it within a month — and much of it is available immediately through the API on Business plans.

Deleting your account removes your organization's data. Retrieved copies of publishers' own documents are deleted after two years in any case; the note of what was retrieved and where the current version lives stays, because that remains true and useful. What we have to keep afterwards, and for how long, is in the privacy notice.

For a formal vendor review

If your organization runs a security review before buying, we keep a full questionnaire response ready to send: tenant isolation, encryption, access control, application security, AI handling, logging, backups, incident response and sub-processors — with a section listing what we do not have, because your reviewer will find that anyway and it is better read from us.

Ask and we will send it the same day. If you would rather have our answers on your own form, send the form.

The documents

The data processing agreement applies automatically to every customer and needs no signature — it forms part of the terms. A signed counterpart is available on request if your procurement file needs one. Last updated 28 August 2026.