Data processing addendum

Effective October 13, 2026

This addendum applies when Grantory processes personal data on behalf of a customer organization. It forms part of the terms of service and is meant to meet Article 28 of the GDPR.

1. Roles

The customer is the controller. Grantory is the processor and acts only on the customer's documented instructions, which are these terms, the addendum, and the customer's use of the service.

2. Details of processing

Subject matter
Hosting and operating Grantory for the customer.
Duration
The term of the agreement, plus the deletion period in section 8.
Nature and purpose
Storing, organizing and displaying access requests, approvals, grants, reviews and findings, and answering MCP queries from the customer's own keys.
Data subjects
The customer's employees, contractors and other people listed in its access model or using its request form.
Categories of data
Names, work emails, organization and team roles, access requests and reasons, approvals, provisioning notes, dates, findings and audit events.
Special categories
None. The customer agrees not to submit them.

3. Our obligations

  • People who work on the service are bound by confidentiality.
  • We keep the technical and organizational measures in section 9 in place.
  • We help the customer answer data subject requests and carry out impact assessments where the service is involved.
  • We tell the customer if we believe an instruction breaks data protection law.

4. Subprocessors

The customer authorizes the subprocessors listed on the subprocessors page. We announce new subprocessors there at least 30 days in advance. The customer may object on reasonable data protection grounds, and if we cannot address the objection, may cancel without penalty. Each subprocessor is bound by terms at least as protective as these.

5. Transfers

Personal data is transferred outside the European Economic Area only under an adequacy decision or the standard contractual clauses, which are incorporated here by reference where needed.

6. Personal data breaches

We notify the customer without undue delay, and no later than 72 hours after becoming aware of a breach affecting its data. The notice describes what happened, the data involved, the likely effects, and what we are doing about it.

7. Audits

We make available the information needed to show compliance with this addendum. The customer may audit once a year with 30 days' notice, at its own cost, in a way that does not expose other customers' data.

8. Return and deletion

At the end of the agreement, customer data is deleted within 30 days of the end of the paid period, and removed from backups within a further 30 days, unless the law requires us to keep it.

9. Technical and organizational measures

  • Encryption in transit for all traffic to the service.
  • Every query scoped to the customer's organization. Cross-tenant access is covered by automated tests.
  • Passwords and MCP keys stored only as hashes.
  • Role-based access inside each organization, with separation between requester, approver and provisioner.
  • An audit log of changes to access, membership and configuration.
  • No connectors to customer infrastructure. The only outbound integration is a customer-configured Slack webhook.
  • Production access limited to the people who operate the service.