Privacy Policy

Who We Are

GRCfy ("we", "us", "our") is an enterprise compliance orchestration platform operated by GRCfy Technologies Private Ltd ("the Company"). The platform enables audit firms and their client organisations to manage audits, controls, findings, and evidence in a structured, role-based environment.

This Privacy Policy applies to all users of the GRCfy web application, including audit administrators, auditors, compliance reviewers, and client-side users. It describes how we collect, process, store, and protect personal information in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), the Digital Personal Data Protection Act 2023 (DPDP Act), and other relevant regulations.

For questions about this policy or to exercise your rights, contact our Data Protection Officer at privacy@grcfy.com.

Information We Collect

2.1 Account & Identity Data

When an administrator creates a user account on your behalf, or when you register directly, we collect:

• Full name and email address
• Job title and department (optional, provided by you)
• Phone number (optional, provided by you)
• Hashed password (we never store plaintext passwords)
• Role assignments (e.g., auditor, compliance viewer, client admin)

2.2 Organisation Data

We collect information about your organisation to provision and manage your account:

• Company name, type, and registration details
• Registered and billing address
• Contact email, phone, and website
• Subscription plan and billing records

2.3 Audit & Compliance Content

As part of the service, users upload and generate compliance data including audit control assessments, findings, remediation notes, and evidence files (documents, spreadsheets, images). This content belongs to your organisation and is processed by us solely to operate the platform.

2.4 Usage & Technical Data

We automatically collect technical data to operate and secure the platform:

• IP address and browser user-agent string
• Login timestamps and session identifiers
• Actions taken within the platform (stored in our immutable audit trail)
• File sizes for storage quota management

2.5 Single Sign-On Data

If your organisation configures SSO (SAML 2.0, OIDC, or LDAP), we receive identity attributes from your Identity Provider (e.g., name, email, group memberships) solely to authenticate you and provision your account. We do not retain IdP tokens beyond the session.

How We Use Your Information

We do not use personal data for advertising, sell it to third parties, or use it to train AI models.

Legal Basis for Processing

Where GDPR or similar laws apply, we rely on the following legal bases:

• Contract performance — processing necessary to provide the service under your subscription agreement.
• Legitimate interests — security monitoring, fraud prevention, and platform improvement, where these do not override your fundamental rights.
• Legal obligation — where processing is required to comply with applicable law (e.g., retaining records of data deletion requests under the DPDP Act).
• Consent — where specifically sought (e.g., optional marketing communications, if applicable).

Data Sharing & Disclosure

We do not sell personal data. We share data only in the following circumstances:

5.1 Within Your Organisation

Audit content and user information is visible to authorised members of your audit firm or client organisation in accordance with the role-based access controls you configure.

5.2 Service Providers (Sub-processors)

We engage a limited number of sub-processors to operate the platform. All sub-processors are bound by data processing agreements and may only process data on our documented instructions.

5.3 Legal Requirements

We may disclose data if required to do so by law, court order, or to protect the rights, property, or safety of the Company, our users, or the public.

Data Storage & Security

We implement industry-standard technical and organisational measures to protect your data:

• All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Passwords are hashed using bcrypt with a minimum cost factor of 10; plaintext passwords are never stored or logged.
• Database credentials and sensitive configuration values are encrypted at rest using Laravel's AES-256-CBC encryption.
• All significant user actions are recorded in an immutable, append-only audit trail stored in an isolated compliance database.
• Access to production systems is restricted to authorised personnel via role-based controls and multi-factor authentication.
• Storage quotas and per-file size limits are enforced to prevent abuse.
• Evidence files uploaded to the platform are stored in Amazon Web Services S3 (region: ap-south-1, Mumbai, India), encrypted at rest using AES-256 (SSE-S3) with S3 Object Lock enabled.
• Database backups and log archives are written daily to the same AWS S3 bucket, retained for 30 days, and automatically purged thereafter.

While we take extensive precautions, no system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for promptly notifying us of any suspected unauthorised access at security@grcfy.com.

Data Retention

We retain personal data for as long as your organisation's account is active and for a defined period thereafter:

• Active accounts: Data is retained for the duration of your subscription.
• Cancelled or expired subscriptions: A grace period applies (configurable by the platform administrator, default 30 days) during which data remains accessible. After the grace period, user accounts are deactivated.
• Data retention window: Following deactivation, data is retained for up to 90 days (configurable) before becoming eligible for permanent deletion.
• Audit trail logs: Compliance and activity logs are retained for 90 days in rotating log files and are stored in the dedicated compliance database for the duration of the account.
• Deletion requests: Records of data erasure requests are retained as required by applicable law (e.g., DPDP Act Section 12).

Platform administrators can initiate permanent deletion ("force delete") of records via the Recovery Vault. All such actions are logged immutably with a mandatory reason.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

To exercise any of these rights, contact privacy@grcfy.com. We will respond within 30 days. Note that some rights may be limited where we are required by law to retain data or where the request conflicts with the rights of other users.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority.

Cookies

GRCfy uses strictly necessary cookies only:

• Session cookie (grcfy-session) — maintains your authenticated session. Expires when you close your browser or log out.
• CSRF token cookie (XSRF-TOKEN) — protects against cross-site request forgery. Session-scoped.

Inside the signed-in platform we do not use analytics cookies, tracking pixels, or third-party advertising cookies. No cookie consent banner is required for strictly necessary cookies under most jurisdictions, but we disclose their use here for full transparency.

Public Maestro Lite pages only (sign-in, signup, email code and pricing). If you choose Accept on the notice shown there, we load Google Analytics (Google LLC), which sets cookies (_ga and _ga_*, up to about 2 years) and sends your page visits, approximate location, device and browser information to Google so we can count visitors and see which pages are read. If you choose No thanks, or do nothing, nothing is loaded and no analytics cookie is set. Your choice is kept in your browser (lite_analytics) and you can change it by clearing site data. Google Analytics is never loaded after you sign in, and nothing you enter in your workspace is sent to it. We do not use it for advertising.

Children's Privacy

GRCfy is a professional B2B compliance platform intended solely for use by organisations and their authorised employees and contractors. We do not knowingly collect personal data from individuals under the age of 18. All accounts must be created and managed by adults acting in a professional capacity on behalf of their organisation.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Effective date" and "Last reviewed" fields at the top of this page.
• Notify account administrators via email at least 14 days before the change takes effect.
• Where required by law, seek fresh consent.

Your continued use of the platform after the effective date of a revised policy constitutes your acceptance of the changes.

Contact Us

For all privacy-related enquiries, please contact:

• Data Protection Officer
• GRCfy Technologies Private Ltd
• Email: privacy@grcfy.com
• Support portal: GRCfy