Acceptable use

Effective October 13, 2026

Grantory holds decisions about access. These rules keep it that way and keep it safe for every organization that uses it.

Keep secrets out

• Do not put passwords, tokens, private keys or recovery codes into requests, reasons, provisioning notes or resource instructions.
• Write what was done, not the credential used to do it. "Added to the engineering team on GitHub" is a good note.
• If a secret gets in by mistake, rotate it in the real system and tell us so we can help remove it.

Keep data to what is needed

• Do not submit health data, biometrics, or other special categories of personal data.
• List people by work identity. Personal emails belong only where someone has no work account.

Do not abuse the service

• No attempts to reach another organization's data, bypass roles, or guess keys.
• No load testing, scanning or automated scraping without our written agreement.
• No use of request forms to send spam or collect data from people who did not expect it.
• No reselling or sharing accounts and MCP keys outside your organization.

Report problems

If you find a vulnerability, write to hello@grantory.pro before telling anyone else, and give us a reasonable time to fix it. We will not take action against good-faith research that follows this page.

If the rules are broken

We may remove the content, suspend the account or key involved, or in serious cases suspend the organization, as described in the terms of service.