GRAFT.TODAY is hosted entirely on Vercel, a platform built on AWS and Google Cloud. Vercel provides:

• Automatic HTTPS/TLS on all routes — there is no HTTP fallback
• DDoS mitigation and edge-level rate limiting
• Global CDN distribution with automatic failover
• Isolated serverless functions — each request runs in its own execution context

Our database requires SSL for every connection (sslmode=require). Data at rest and in transit between application and database is encrypted.

All user authentication is handled by Clerk, a dedicated identity platform. GRAFT.TODAY never stores your password — Clerk manages credential storage, session tokens, and login flows.

• Passwords are hashed by Clerk using industry-standard algorithms — we cannot see them
• Sessions use short-lived, signed JWT tokens
• Multi-factor authentication (MFA) is available and recommended for your account
• Every authenticated API request and server action verifies your session inside the handler — not just at the middleware edge

Access to your organisation’s data within the platform is scoped to your Clerk organisation. No other tenant can access yourtriaged initiated enquiries conversations, or settings — this is enforced at the data-query layer, not just the UI.

GRAFT.TODAY is a multi-tenant platform — many businesses share the same infrastructure. Here is how we ensure one tenant cannot access another’s data:

• Every record in our database is scoped to a clientId that maps 1-to-1 with your Clerk organisation
• All data-access queries filter by clientId in the service layer — there is no reliance on UI-layer filtering alone
• The platform owner account has elevated access for support purposes only; access is logged

If you use GRAFT.TODAY to serve your own customers (e.g. deploying a Ai Assistant widget on your site), your customers’ data is similarly isolated under your organisation and is not visible to other GRAFT.TODAY tenants.

All payment processing is handled exclusively by Paddle as our Merchant of Record. GRAFT.TODAY never sees, handles, or stores your payment card details. This means:

• Your card number, CVV, and expiry date go directly to Paddle’s PCI-DSS compliant infrastructure
• Paddle issues invoices, handles refunds, and manages subscription billing — our servers are never in the payment data path
• Subscription status webhooks from Paddle are verified using a cryptographic signing secret before being processed

GRAFT.TODAY uses AI models to power the Ai Assistant and engagement features. We want to be fully transparent about which providers receive your data and under what conditions.

We apply data minimisation: AI calls receive only the context necessary for the specific task. We do not send your entire database to any AI provider. Conversation messages are sent to the AI model in real time and are not persisted by us on third-party AI platforms.

When you embed the GRAFT AI Assistant widget on your website, a script loads an iframe served from GRAFT.TODAY. Here is what that means for your site’s security:

• The widget runs in an isolated iframe — it cannot access your page’s DOM, cookies, or local storage
• Your GRAFT.TODAY client ID is used to identify your Ai Assistant configuration. It is a non-secret public identifier — possessing it does not grant access to your dashboard or data
• Chat conversations are transmitted over HTTPS and stored in your account’s isolated data scope
• The widget does not inject any third-party advertising scripts onto your page

We recommend embedding the widget via our official script tag. Custom or modified embed code is not supported and may introduce security risks.

To be explicit about our data practices:

• We do not sell your data or your customers’ data to third parties
• We do not use your conversation data or visitor context for advertising targeting
• We do not allow any AI provider to train on your data via API calls (per their respective policies)
• We do not share your data between tenants
• We do not store payment card details — ever

If you discover a vulnerability or security issue in GRAFT.TODAY, please report it responsibly before public disclosure. We take all reports seriously and will respond promptly.

We ask that you do not access, modify, or delete data belonging to other users while investigating any potential issue, and that you give us a reasonable time to resolve the issue before disclosing it publicly.

Security is a shared responsibility. As a GRAFT.TODAY subscriber, you can significantly reduce risk by:

• Enabling multi-factor authentication (MFA) on your account
• Using a strong, unique password via your identity provider
• Reviewing who has access to your GRAFT.TODAY organisation and removing members who no longer need it
• Treating AI-generated content as a draft — review it for accuracy and appropriateness before relying on it
• Reporting any suspicious activity on your account to us immediately at hello@graft.today