Privacy Policy — GRCfy Maestro

Section 01

Who We Are

GRCfy Maestro ("we", "us", "our") is an enterprise compliance orchestration platform operated by GRCfy Technologies Private Ltd ("the Company"). The platform enables audit firms and their client organisations to manage audits, controls, findings, and evidence in a structured, role-based environment.

This Privacy Policy applies to all users of the GRCfy Maestro web application, including audit administrators, auditors, compliance reviewers, and client-side users. It describes how we collect, process, store, and protect personal information in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), the Digital Personal Data Protection Act 2023 (DPDP Act), and other relevant regulations.

For questions about this policy or to exercise your rights, contact our Data Protection Officer at privacy@grcfy.com.

Section 02

Information We Collect

2.1 Account & Identity Data

When an administrator creates a user account on your behalf, or when you register directly, we collect:

Full name and email address
Job title and department (optional, provided by you)
Phone number (optional, provided by you)
Hashed password (we never store plaintext passwords)
Role assignments (e.g., auditor, compliance viewer, client admin)

2.2 Organisation Data

We collect information about your organisation to provision and manage your account:

Company name, type, and registration details
Registered and billing address
Contact email, phone, and website
Subscription plan and billing records

2.3 Audit & Compliance Content

As part of the service, users upload and generate compliance data including audit control assessments, findings, remediation notes, and evidence files (documents, spreadsheets, images). This content belongs to your organisation and is processed by us solely to operate the platform.

2.4 Usage & Technical Data

We automatically collect technical data to operate and secure the platform:

IP address and browser user-agent string
Login timestamps and session identifiers
Actions taken within the platform (stored in our immutable audit trail)
File sizes for storage quota management

2.5 Single Sign-On Data

If your organisation configures SSO (SAML 2.0, OIDC, or LDAP), we receive identity attributes from your Identity Provider (e.g., name, email, group memberships) solely to authenticate you and provision your account. We do not retain IdP tokens beyond the session.

Section 03

How We Use Your Information

Purpose	Data Used
Account authentication and access control	Name, email, hashed password, roles, SSO attributes
Delivering the compliance management service	Audit content, findings, evidence, control data
Subscription and billing management	Organisation details, subscription plan, credit usage
Platform security, fraud prevention, and audit logging	IP address, user-agent, session data, activity logs
Sending transactional notifications	Email, name — for audit assignments, evidence flags, renewal reminders
Compliance with legal obligations (including DPDP Act, GDPR)	Identity data, activity logs, deletion records
Improving the platform (aggregated, anonymised analytics only)	Anonymised usage patterns — no individual tracking

We do not use personal data for advertising, sell it to third parties, or use it to train AI models.

AI-Assisted Processing (optional feature)

On AI-enabled subscription tiers, auditors may optionally trigger AI analysis of accepted evidence files against individual audit controls. When this feature is used:

What is processed: Extracted text from evidence documents is passed through a two-layer PII scrubbing pipeline (internal regex engine + AWS Bedrock Guardrail with NAME and ADDRESS filters) before being sent to Claude (by Anthropic) via AWS Bedrock in ap-south-1 (Mumbai, India).
What is not processed: Original evidence files, user identities, organisation names, and all other platform data are excluded from AI prompts.
No automated decisions: AI findings are advisory only. A qualified auditor reviews and approves all AI output before it is committed to the audit record (Human-in-the-Loop design).
No model training: Anthropic's commercial API terms prohibit the use of customer-submitted data to train AI models.
Data residency: All AI inference occurs in ap-south-1 (Mumbai, India).

For full details, see our AI Processing Disclosure and the AI Processing Addendum (Section 17) to our DPA.

Section 04

Legal Basis for Processing

Where GDPR or similar laws apply, we rely on the following legal bases:

Contract performance — processing necessary to provide the service under your subscription agreement.
Legitimate interests — security monitoring, fraud prevention, and platform improvement, where these do not override your fundamental rights.
Legal obligation — where processing is required to comply with applicable law (e.g., retaining records of data deletion requests under the DPDP Act).
Consent — where specifically sought (e.g., optional marketing communications, if applicable).

Section 05

Data Sharing & Disclosure

We do not sell personal data. We share data only in the following circumstances:

5.1 Within Your Organisation

Audit content and user information is visible to authorised members of your audit firm or client organisation in accordance with the role-based access controls you configure.

5.2 Service Providers (Sub-processors)

We engage a limited number of sub-processors to operate the platform. All sub-processors are bound by data processing agreements and may only process data on our documented instructions.

Sub-processor	Purpose	Data Location	Safeguards
Squarebrothers Internet Services Chennai, India	Platform application and database hosting	Chennai, India	Data encrypted in transit (TLS 1.2+); databases not publicly accessible; MFA-restricted admin access
Amazon Web Services (AWS) S3 ap-south-1, Mumbai, India	Evidence file storage; daily database backups; application log archives	ap-south-1 (Mumbai, India)	AES-256 server-side encryption (SSE-S3); S3 Object Lock enabled; access restricted to a dedicated IAM user with least-privilege policy; data does not leave India
Cloudflare	DDoS protection, TLS termination, CDN	Global edge network (no data stored)	Traffic only; no customer data persisted at edge
Hosting Raja Maharashtra, India	Transactional email delivery (notifications, alerts, invoices)	India	Only recipient address and message content transmitted; no passwords or audit data included
Anthropic PBC via AWS Bedrock, ap-south-1	AI evidence analysis — optional feature on AI-enabled subscription tiers only. Processes scrubbed evidence text to generate compliance findings against audit controls.	ap-south-1 (Mumbai, India)	Structured PII (email, phone, Aadhaar, PAN, etc.) is removed by our internal scrubber before transmission. Named entities (names, addresses) are filtered by an AWS Bedrock Guardrail. Anthropic does not train its models on API-submitted data. No evidence text is stored post-inference.
Amazon Web Services — Textract ap-south-1, Mumbai, India	OCR text extraction from image files and scanned PDFs submitted as audit evidence — used only when AI analysis is triggered on image-type evidence.	ap-south-1 (Mumbai, India)	Image/scan is transmitted for OCR only; AWS Textract does not retain the file after extraction. Text output is then PII-scrubbed before being passed to the AI model.

5.3 Legal Requirements

We may disclose data if required to do so by law, court order, or to protect the rights, property, or safety of the Company, our users, or the public.

            Company-hosted & client-hosted databases: If your organisation has configured
            GRCfy Maestro to store audit data on your own database server,
            that data resides under your direct control and infrastructure. The Company only processes data
            necessary to operate the application layer.
        

Section 06

Data Storage & Security

We implement industry-standard technical and organisational measures to protect your data:

All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
Passwords are hashed using bcrypt with a minimum cost factor of 10; plaintext passwords are never stored or logged.
Database credentials and sensitive configuration values are encrypted at rest using Laravel's AES-256-CBC encryption.
All significant user actions are recorded in an immutable, append-only audit trail stored in an isolated compliance database.
Access to production systems is restricted to authorised personnel via role-based controls and multi-factor authentication.
Storage quotas and per-file size limits are enforced to prevent abuse.
Evidence files uploaded to the platform are stored in Amazon Web Services S3 (region: ap-south-1, Mumbai, India), encrypted at rest using AES-256 (SSE-S3) with S3 Object Lock enabled.
Database backups and log archives are written daily to the same AWS S3 bucket, retained for 30 days, and automatically purged thereafter.

While we take extensive precautions, no system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for promptly notifying us of any suspected unauthorised access at security@grcfy.com.

Data localisation: All personal data processed through GRCfy Maestro is stored exclusively within India — platform databases on servers hosted by Squarebrothers Internet Services (Chennai), and evidence files and backups on Amazon Web Services S3 (ap-south-1, Mumbai). We do not transfer personal data to servers outside India. Any future cross-border transfer will only occur in compliance with applicable Indian law, including any adequacy frameworks or conditions notified under the DPDP Act 2023.

Section 07

Data Retention

We retain personal data for as long as your organisation's account is active and for a defined period thereafter:

Active accounts: Data is retained for the duration of your subscription.
Cancelled or expired subscriptions: A grace period applies (configurable by the platform administrator, default 30 days) during which data remains accessible. After the grace period, user accounts are deactivated.
Data retention window: Following deactivation, data is retained for up to 90 days (configurable) before becoming eligible for permanent deletion.
Audit trail logs: Compliance and activity logs are retained for 90 days in rotating log files and are stored in the dedicated compliance database for the duration of the account.
Deletion requests: Records of data erasure requests are retained as required by applicable law (e.g., DPDP Act Section 12).

Platform administrators can initiate permanent deletion ("force delete") of records via the Recovery Vault. All such actions are logged immutably with a mandatory reason.

Section 08

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right	Description
Access	Request a copy of the personal data we hold about you.
Correction	Update inaccurate or incomplete personal data via your profile settings or by contacting us.
Erasure	Request deletion of your personal data where there is no overriding legal obligation to retain it.
Portability	Receive a structured, machine-readable export of data you have provided to us.
Restriction	Request that we limit how we use your data in certain circumstances.
Objection	Object to processing based on legitimate interests.
Withdraw consent	Where processing is based on consent, withdraw it at any time without affecting prior processing.
Nomination	Under the DPDP Act 2023 (Section 14), you may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. Submit nomination requests to privacy@grcfy.com.

To exercise any of these rights, contact privacy@grcfy.com. We will respond within 30 days. Note that some rights may be limited where we are required by law to retain data or where the request conflicts with the rights of other users.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority (in India: the Data Protection Board of India).

Section 09

Cookies

GRCfy Maestro uses strictly necessary cookies only:

Session cookie (GRCfy_session) — maintains your authenticated session. Expires when you close your browser or log out.
CSRF token cookie (XSRF-TOKEN) — protects against cross-site request forgery. Session-scoped.

We do not use analytics cookies, tracking pixels, or third-party advertising cookies. No cookie consent banner is required for strictly necessary cookies under most jurisdictions, but we disclose their use here for full transparency.

Section 10

Children's Privacy

GRCfy Maestro is a professional B2B compliance platform intended solely for use by organisations and their authorised employees and contractors. We do not knowingly collect personal data from individuals under the age of 18. All accounts must be created and managed by adults acting in a professional capacity on behalf of their organisation.

Section 11

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

Update the "Effective date" and "Last reviewed" fields at the top of this page.
Notify account administrators via email at least 14 days before the change takes effect.
Where required by law, seek fresh consent.

Your continued use of the platform after the effective date of a revised policy constitutes your acceptance of the changes.

Section 12

Contact Us & Grievance Officer

For all privacy-related enquiries or to exercise your rights, please contact our Data Protection Officer:

Data Protection Officer
GRCfy Technologies Private Ltd
Innov8 Millenia, 2nd Floor, East Wing, RMZ Millenia Business Park,
Campus 1A, No. 143, Dr. M.G.R. Road (North Veeranam Salai),
Perungudi, Sholinganallur, Chennai – 600096, Tamil Nadu, India
Email: privacy@grcfy.com
Support portal: GRCfy

Grievance Officer (DPDP Act 2023 — Section 13):
In accordance with the Digital Personal Data Protection Act 2023, we have designated a Grievance Officer to address complaints and queries relating to personal data processing. If you believe your data rights have not been respected, you may raise a grievance with:

Grievance Officer: Moorthy Smani
Organisation: GRCfy Technologies Private Ltd
Email: grievance@grcfy.com
Response time: We will acknowledge your grievance within 48 hours and aim to resolve it within 30 days.

If your grievance is not resolved to your satisfaction, you may escalate the matter to the Data Protection Board of India once it is constituted under the DPDP Act 2023.