Security first. Your data stays yours.
A deployment of your own in the EU, encrypted throughout, never used to train AI, and every action on record.
Standards
- GDPRCompliant
- EU AI ActCompliant
- Penetration testTested, report under NDA
- ISO 27001In progress
Where Grasp runs.
In our cloud in the EU today. On your own servers is on its way.
In our EU cloud
- A deployment of its own for your organisation
- All your data stored in the EU
- Every subprocessor listed in our DPA
On your own servers In development
- We are building Grasp to run on-premises, inside your network
- If your organisation needs it, we work it out with you
- Your data then stays within your own infrastructure
How we protect your data.
The short answers. Our data processing agreement (DPA) has the full detail.
Your data
Encrypted throughout.
Every connection is encrypted, and so is everything we store.
Never used to train AI.
Not to train, fine-tune or evaluate any model, ours or anyone else’s.
Only what you connect.
With the permissions you approve. Never a private mailbox, never a whole workspace.
Processes, not people.
We measure how work runs. Hours are never shown per person.
Access
No standing access.
Our support reaches your data only with your approval, for a set time, and on your record.
Least privilege.
Our own tools need multi-factor sign-in, and each person gets only the access their work needs.
Every action on record.
Every read, action and model call is logged, our own access included. Nothing is ever removed.
Yours to take.
A full export when you leave, and your data deleted after the agreed wind-down.
AI
One gateway for every model call.
Nothing reaches an AI model another way, so your rules always apply.
You choose the models.
Only providers that do not keep or train on your data are offered.
In the EU where it matters.
Keep a workflow or a connection on models that run within the EU.
Rules and budgets.
Decide which data may reach which model, with limits per workflow and per person.
Everything for your review.
What your security, legal and privacy teams will ask for.
Common questions
Where is our data stored?
In the EU, in a deployment of its own for your organisation. Our DPA includes the subprocessor list, so you can review which providers are involved.
Can we run Grasp on our own servers?
We are building on-premises now. If your organisation needs it, talk to us and we will work it out with you.
Is our data used to train AI?
No. Customer data is never used to train, fine-tune or evaluate AI models. We share the terms of our model providers under NDA.
How do you handle GDPR?
Customer data is stored in the EU. We sign a DPA, publish our subprocessor list and help with requests from people about their own data.
Has Grasp been penetration tested?
Yes. The platform has been penetration tested, and we share the results under NDA as part of a security review.
Are you certified?
We are working towards ISO 27001. We comply with GDPR and the EU AI Act, and for a security review we share our current controls and evidence under NDA.
Do you comply with the EU AI Act?
Yes, for everything that applies to Grasp: it is clear when AI is at work, a person decides where it matters, and every model call is logged. How your own organisation uses AI stays your responsibility.
Does using Grasp make us compliant?
No tool can make your organisation compliant on its own. Grasp keeps AI use in view, documented and decided by people. Your obligations depend on how your organisation uses AI.
Should our works council know?
Yes, before our AI interviewer talks to employees or an assistant joins a team channel. We measure how work runs, never individuals.
What happens if we leave?
You get a full export on request, and we permanently delete customer data after the agreed wind-down period.
How do we report a vulnerability?
Email info@joingrasp.com with the affected URL, steps to reproduce and the potential impact. Please avoid accessing customer data or disrupting the service.
Need to go deeper?
For a security review, talk to us. We share our controls under NDA.