Trust
Security and privacy at Grotivo
Your growth numbers, plans and team discussions are some of your most sensitive information. This page explains, in plain words, how Grotivo protects them, what you control, and which providers help us run the service.
Every company is kept separate
- Each request is checked against the signed-in person's own company, so one company can never see another's data.
- Roles decide who sees what inside your company: super admin, admins, executives and managers.
- The super admin controls who is invited, who is removed and who can use team chat.
Encryption
- Everything travels over HTTPS (TLS), and browsers are told to always use a secure connection (HSTS).
- The database is encrypted at rest by Cloudflare.
- Connection tokens for your other systems and saved-card tokens are encrypted again with AES-256 before they are stored.
- API keys you create are stored only as a one-way hash, so even we cannot read them back.
Sign-in and accounts
- No passwords are stored by default: people sign in with Google, Microsoft or a one-time code sent to their email.
- Sign-in sessions use signed, secure, HttpOnly cookies that scripts on the page cannot read.
- A new browser must confirm by email, and again at least every 7 days.
- A human check and attempt limits stop bots, mass sign-ups and code guessing.
AI and your data
- Grotivo uses OpenAI's business API. Data sent through the API is not used to train OpenAI's models by default.
- Only the context needed for each answer or report is sent, never your whole account.
- Every recommended action needs a person's approval. Nothing is changed in your systems on its own.
- Tom is built to never reveal internal system details or other customers' information.
Payments
- Card payments are handled by Flutterwave, a PCI DSS compliant payment provider. Full card numbers never reach Grotivo.
- Every payment is double-checked with Flutterwave before it is applied, and payment messages must carry our secret signature.
Your control over your data
- Your company's data belongs to you. The super admin can download a full copy at any time from Settings.
- The super admin can ask us to delete the company's data from Settings. We complete deletions within 30 days.
- Payment and invoice records are kept only as long as tax law requires.
Our own team
- Grotivo staff use a separate back office with limited roles (owner, sales, support, finance).
- Sensitive staff actions, such as changing a plan or deleting data, need a reason and are recorded in an audit log.
Platform protection and recovery
- Grotivo runs on Cloudflare's global network, with built-in protection against attacks that try to overload websites (DDoS).
- The database can be restored to any point in the recent past (Cloudflare D1 point-in-time recovery).
- Browser security headers protect against clickjacking and content-type attacks on every page.
Privacy-friendly analytics
- Our own visit and click analytics use no cookies and never store IP addresses.
- Meta's ads cookies run only for visitors who accept them, and never see workspace data.
Email you can trust
- Grotivo emails come from grotivo.com, protected with SPF, DKIM and DMARC so others cannot easily fake them.
- We will never ask for your sign-in code by phone or chat.
Compliance status
| UK GDPR and EU GDPR | We act as your data processor. Our data processing agreement sets out our duties. |
| Nigeria Data Protection Act 2023 | Personal data is handled under the Act's principles and lawful bases. |
| Data processing agreement | Available to every customer, online at grotivo.com/dpa. |
| SOC 2 | Not yet audited. Planned as Grotivo grows. We are happy to answer your security questionnaire. |
| Independent penetration test | Planned. |
Providers that process data for us (subprocessors)
We tell customers at least 30 days before adding a new provider that handles workspace data, by email and on this page.
| Provider | What for | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database, file delivery, email routing and bot protection | All workspace data | Global network, company in the USA |
| OpenAI, L.L.C. | AI analysis: Tom, department advisors, reports and recommendations | Only the business context needed for each request | USA |
| Resend | Sending Grotivo emails (sign-in codes, invitations, reports, invoices) | Names, email addresses and email content | EU sending region (Ireland), company in the USA |
| Flutterwave | Card payments, saved cards and refunds | Billing name, email, company and card details (held by Flutterwave, never by Grotivo) | Nigeria and global |
| Google LLCOnly if you choose Google sign-in | "Continue with Google" sign-in | Name and email address | USA |
| Microsoft CorporationOnly if you choose Microsoft sign-in | "Continue with Microsoft" sign-in | Name and email address | USA |
| Trustpilot A/S | Independent review invitations | Name and email address | Denmark (EU) |
| Meta PlatformsOnly for visitors who accept marketing cookies | Measuring Grotivo's own ads | Website visits and sign-up events, never workspace data | Ireland and USA |
Systems you connect yourself (for example HubSpot, Shopify or your social accounts) receive and send data on your instructions under your own agreements with them.
Report a security issue
If you think you have found a vulnerability, email privacy@grotivo.com with the details. Please give us reasonable time to fix it before telling anyone else. We will reply within 3 working days.
Read more in our privacy policy and data processing agreement.