Security and your data
Your prices, your people's bank details and your clients live in one database in London, walled off per company on the database server, and checked by 105 automated security tests every time we deploy. This page says exactly how, in plain English, with the precise facts for your IT person or main contractor.
Last reviewed 20 October 2026. Every claim here is written from the code and configuration as built, not from a policy document.
- Hosted in London (eu-west-2), encrypted in transit and at rest
- Row-level security on every table, filtered by your company id
- Workers never see prices, margins or colleagues' bank details
- Card numbers go to Stripe, never through Graftum
- Nightly backups kept 14 days, plus one-click full export
- ICO registered (ZC217261), UK GDPR, 30-day deletion
The short version
Six things a firm owner should know before putting the business on Graftum.
One Postgres database with Supabase in the London region. Automatic encryption in transit (HTTPS everywhere) and at rest. The database itself is not copied abroad. Like every app, some messages leave it on purpose: texts go through Twilio, emails through Resend, push notifications through Apple and Google, and card payments through Stripe — each receives only what that message needs.
Every table has row-level security switched on. The database itself adds "where company = yours" to every read and write, so a bug in the app, or a clever request, cannot reach another firm's rows.
Electricians and viewers are blocked at database level from quotes, invoices, contracts, valuations, costs, clients and colleagues' NI or bank rows. They see their own hours, photos, receipts and time off.
105 security checks run against the live database every time code is pushed, inside a transaction that is rolled back. If one fails, the deploy fails.
Clients pay invoices by card on your own Stripe account. Card numbers never touch Graftum. We only record that the invoice was paid.
Full JSON backup and CSV exports from Settings, nightly backups kept 14 days, and account deletion within 30 days of one email. No exit fees.
Where your data lives
One database, one country, encrypted both ways.
Graftum runs on Supabase, a managed Postgres service. Our project is in the London region (eu-west-2), United Kingdom. That is where your jobs, quotes, timesheets, pay runs, photos and backups are stored. Data is encrypted on the wire (HTTPS, with HSTS so browsers refuse to downgrade) and at rest on disk.
The website and app pages themselves are static files served over HTTPS by Netlify. They contain no customer data; every piece of data you see is fetched from the London database after you sign in.
Emails (invites, day sheets, login codes) go out through Resend, text messages through Twilio, and card payments through Stripe. Each receives only what it needs to deliver that one message or payment. The full list of what we share and why is in the privacy policy.
Hosting facts
- Database
- Supabase managed Postgres, project region
eu-west-2(London) - Encryption
- TLS in transit; encryption at rest on the managed database and storage
- Transport
- HTTPS only;
Strict-Transport-Security: max-age=31536000; includeSubDomains - Headers
X-Frame-Options: SAMEORIGIN· CSPframe-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self' https://*.supabase.co·X-Content-Type-Options: nosniff·Referrer-Policy: strict-origin-when-cross-origin(no-referreron pages that carry a private token) ·Permissions-Policy: camera=(self), microphone=(self), geolocation=(self), payment=(), usb=()- Header check
- A scheduled job fetches the live site every morning and fails if any of those headers is missing
- Static site
- Netlify CDN serves HTML, CSS and JS only; no customer data in static files
- Sub-processors
- Supabase (database, storage, auth), Netlify (static hosting), Resend (email), Twilio (SMS), Stripe (card payments)
Who can see what
Six roles. The owner sees everything; everyone else sees what their job needs, and the limits are enforced by the database, not just hidden in the app.
| Role | Sees and does | Cannot |
|---|---|---|
| Owner | Everything: jobs, money, team, settings, billing, backups and exports. The only role that can hand over ownership.One per company; created at sign-up. | Change fields only Graftum sets (plan, trial, suspension, marketplace verification) or back-date the company. |
| Admin | Runs the office: quotes, invoices, contracts, valuations, pay runs, team, invites and settings. Sees money by default. | Make themselves owner, demote the owner, or read another company's data. |
| Site manager | Runs the site: schedule, timesheets, day sheets, who is where, progress and snags. | See rates, budgets, quote values or cash unless the owner ticks that role under "Who sees money" in Settings. |
| Supervisor | Same site tools as a site manager, for a smaller crew. | See money unless the owner switches it on for the role. |
| Electrician | The worker app: own hours, clock-in, photos, receipts, time off, own Team row, notes on jobs they are on.The role name is "electrician" whatever the trade. | Read quotes, invoices, contracts, valuations, costs, clients, pending invites or a colleague's NI and bank row. Change the bank details printed on invoices. Blocked at database level. |
| Viewer | Read-only on the pages the owner allows. | Change anything. Same database limits as an electrician. |
How the wall between companies works
Every table in the database has row-level security switched on (203 tables at the time of writing; the count is checked, not estimated). Each policy compares the row's company id with the signed-in person's company, looked up on the server from their session. A query that asks for "all invoices" only ever returns yours, no matter who wrote the query or how. The owner can share one job with one named client by creating a link; that link goes through a narrow gate that checks the share before returning anything, and you can switch it off at any time. Details are in the data guarantee.
Graftum staff with a platform login see all companies only in a separate admin panel. Inside the CRM or the app, a Graftum admin sees their own company and nothing else, and the security tests check that on every deploy.
How we test it
A security promise you cannot check is a policy. Ours is a test suite that blocks the deploy if it fails.
When code is pushed, a GitHub Action deploys the database changes and then runs a pgTAP test file against the live database, inside one transaction that is always rolled back. The tests create throw-away companies and users, act as each of them in turn, and try to do things they should not be able to do. One failure stops the deploy and shows which check broke.
- Firm B cannot read, approve or change anything belonging to firm A
- Another company cannot see an offer, a test sheet, a site record or a reference row
- A Graftum admin in the CRM sees only their own company
- An admin cannot make themselves owner or demote the owner
- An owner cannot change their plan, trial, suspension or verification
- A worker cannot read a colleague's NI or bank row, pending invites, or offers and prices
- Taking a colleague's name does not give access to their timesheets or pay
- Offer links use a long random token shown once; only its hash is stored
- A guessed token opens nothing; a switched-off link no longer opens
- Made-up links for invoices, call-out reports, EICR bookings, worker pages and crew profiles show nothing
- The public job board and SEO feed carry no phone numbers or poster details
- Homeowner leads need the SMS code; an unverified firm cannot take a homeowner's contact details
- The 11th request from one connection in an hour is refused
- Nobody can opt out someone else's phone without the SMS code
- Accepting a quote needs a real signature, on the version the client actually saw
- An accepted offer cannot be changed, un-accepted or accepted twice
- A sent offer cannot be deleted; it stays as proof
- Once the office enters a test sheet, the electrician cannot change it
- Joining by a company's link without an invite creates a pending request, not access
- An unconfirmed email is not attached to the inviting company until it is confirmed
- A pending request cannot be overwritten by someone else
The test file lives in the repository as supabase/tests/security_test.sql and declares plan(105). A second scheduled check fetches the live site every morning and fails if any security header has gone missing.
Sign-in and accounts
Two ways in, rate-limited, with nothing stored that would help an attacker.
Minimum 8 characters. Passwords that appear in known data leaks are refused at sign-up. New accounts confirm their email before they are attached to a company. Password reset is by a one-time link that works once, for about an hour.
For people who forget passwords: a 6-digit code by SMS (to the phone in your Team list) or by email. Stored only as a hash, expires in 10 minutes, 5 attempts, at most 3 codes per person per 15 minutes and 10 per connection per hour. The response is the same whether the account exists or not, so nobody can fish for accounts.
Sessions are Supabase JWTs; every database call carries one and the server derives your company and role from it. Removing someone from Team removes their access, and a revoked email stays out until the office invites it again.
What we do not have yet
There is no two-factor (2FA) sign-in today, and no single sign-on. If either is a condition for your firm or your main contractor, tell us at hello@graftum.com; it helps us order the work.
Payments
Your money, your Stripe account. Graftum is not in the middle.
If you switch on card payments, Graftum connects a Stripe account in your company's name (Stripe Connect, standard account). When a client pays an invoice from its link, the payment page is a Stripe Checkout session created on your account: the card number is typed into Stripe's page, authorised by Stripe, and settled to your bank by Stripe.
Graftum never sees, transmits or stores a card number. What we store is the Stripe session reference and the fact that the invoice is paid, with the date. Only the owner or an admin can connect or manage the Stripe account, and which Stripe account a company uses is not readable without signing in; that is one of the deploy-time tests.
Bank transfer stays the default. If card payments are not set up for your company, the invoice page says so and shows your bank details instead.
Your people's privacy
Workers trust you with their phone number, NI number and bank details. Here is how Graftum treats them.
Inside your company
A worker's NI number and bank details sit in your Team list and are readable by the owner, admins and the worker themself; a colleague on the same site cannot read them, by database policy. Timesheet corrections by the office are logged by a database trigger that cannot be bypassed from the app: every insert, update or delete on a clock-in or an allocation leaves a row with who changed it, the old values and the new ones.
Photos, certificates, receipts and backups live in private storage buckets. The app opens them through signed links that expire (one hour for job photos, five minutes for a backup download). The only public bucket is for the photos a firm chooses to put on its own public marketplace profile.
In the marketplace
Workers on the free crew list get a private page link; nobody can edit or mark them available without it. Firms see trade, area and availability. Phone numbers and contact details are released only to firms Graftum has verified (a flag only Graftum can set; the tests check an owner cannot set it themselves). The public job board and the SEO feed carry no phone numbers at all.
Text messages and PECR
Graftum sends two kinds of SMS: service messages for people already on your team (tomorrow's job, clock-out reminders, login codes), and marketplace messages to workers who signed up for them. Anyone can stop marketplace texts at graftum.com/stop; the number goes on an opt-out list that every send checks, and nobody can opt out someone else's number without the SMS code. Login codes are service messages, not marketing.
Backups, export and leaving
Two layers of backup, three export formats, and a plain exit.
Every night at about 3am a job writes a JSON snapshot of each active company (jobs, quotes, invoices, timesheets, pay runs, clients, settings and more) to private storage, separate from the live database. The last 14 are kept. The owner or an admin downloads any of them from Settings, under Export and backup.
Underneath that, the Supabase project itself takes daily backups of the whole database, in the same London region. That is what we would restore from if the database were lost.
Settings has a one-click full backup (JSON), CSV exports of jobs, quotes and invoices, a team export, and invoice files for Xero and QuickBooks. You do not need to ask us.
Leaving
Email hello@graftum.com with "Delete my account" from the address on the account. We confirm, then delete within 30 days: logins, profiles, timesheets, photos, Network profiles. Records we must keep by law (invoicing) are kept for the statutory period and nothing else. The full list of what goes is on the delete account page. No retention tricks, no exit fees.
Compliance
What we are registered for and what we promise in writing.
Graftum Ltd is registered with the Information Commissioner's Office as a data controller. Company no. 17387844, registered in England and Wales.
You can ask to see, correct, delete, restrict or export the data we hold on you or your people, or withdraw consent. One email, answered within 30 days. If you are unhappy with our answer you can complain to the ICO. See the privacy policy.
Our written promise, in plain English: isolated per company, your leads land only in your account, never sold, yours to take with you. Read it at graftum.com/your-data.
We do not currently hold ISO 27001 or Cyber Essentials certification, and we will not claim it until we do. If your main contractor's supplier questionnaire needs specific answers, send it to hello@graftum.com and we will fill it in from the facts on this page.
What we don't do
- We don't sell your data.Not your prices, not your clients, not your workers' numbers. You pay us, so you are the customer, not the product.
- We don't run adverts on your data.There is no advertising inside the product and your business data is never used to target anything. The one tracking pixel we use (Meta, on some public sign-up pages) loads only if the visitor presses agree, and never sees what they type.
- We don't store card numbers.Card payments are Stripe's job, on your own Stripe account.
- We don't hand workers' phone numbers to unverified firms.Marketplace contact details are gated behind a verification flag only Graftum can set.
- We don't let one company see another.Not through the app, not through a public page, not through a guessed link. The database refuses it, and the tests prove it on every deploy.
- We don't keep you.Export is one click, deletion is one email, and there are no exit fees.
Reporting a security issue
Email hello@graftum.com with what you found and how to reproduce it. We read it personally, usually the same day, Monday to Friday. Please do not access other companies' data beyond what is needed to show the problem, and give us a reasonable time to fix it before publishing. We will tell you what we did about it.
Questions firms ask us
Where is my data stored?
In a Supabase (Postgres) database in the London region (eu-west-2), United Kingdom, encrypted in transit and at rest. Backups are kept in the same project.
Can another company on Graftum see my prices or my team?
No. Every table has row-level security switched on and every query is filtered by your company id on the database server, not in the app. The only way another company sees anything of yours is a share link you create yourself for one named client, and you can switch it off at any time.
Can my electricians see what I charge or what colleagues earn?
No. Worker roles (electrician, viewer) are blocked at database level from quotes, invoices, contracts, valuations, costs and clients, and from colleagues' NI and bank details. They see their own hours, photos, receipts and time off.
Do you store card numbers?
No. Card payments run through Stripe Checkout on your own Stripe account. Card numbers go straight to Stripe and never pass through Graftum; we only record that the invoice was paid.
Do you offer two-factor sign-in?
Not yet. Sign-in is by email and password (minimum 8 characters, passwords found in known data leaks are refused) or by a one-time 6-digit code sent by SMS or email. Two-factor sign-in is on the list; email hello@graftum.com if it is a condition for your firm.
Can I get all my data out and close the account?
Yes. Settings has a full JSON backup button and CSV exports for jobs, quotes and invoices, plus Xero and QuickBooks invoice files. To close the account, email hello@graftum.com and we delete within 30 days. No exit fees.
Put the business on Graftum, keep the data yours.
Set up your company in three minutes. The first three months are free, no card needed, and everything on this page applies from day one.