Security and compliance

Security at Graine, stated plainly.

What we protect, what we hold, what we are still building, and what stays yours to do. Updated 4 November 2026.

Visit the Trust CenterRead the security docs

Quick facts

Legal entity
Mavrix AI Private Limited, trading as Graine AI
Certifications
SOC 2In progressISO/IEC 27001:2022In progress
Agreements
A data processing agreement, and a GDPR standard contractual clauses rider, on request. We do not offer a business associate agreement.
Regions
India (Mumbai); United States (N. Virginia); United Kingdom. Others on request.
Deployment
Our shared cloud, a dedicated instance, or your own cloud or servers.
Security contact
founders@graine.ai

Certifications and compliance

Where each framework stands.

One card each, with a status and one honest line. No badge says more than the page does.

  • SOC 2

    In progress

    We are preparing for a SOC 2 Type I audit and will follow it with a Type II observation period. Neither is complete, and we do not hold a SOC 2 report.

  • ISO/IEC 27001:2022

    In progress

    We are building our information security management system to ISO/IEC 27001:2022. The certification audit has not been completed, and we do not hold a certificate.

  • DPDP Act 2023 (India)

    Aligned controls, program in place

    We run a privacy program and are aligning our controls with India's Digital Personal Data Protection Act and its Rules: a privacy notice, a grievance route, processor terms for customers, and tools for rights requests and retention that are still being built.

  • GDPR

    DPA on request

    Where we process EU personal data for a customer, we act as its processor. Processor terms (a data processing agreement) are available on request.

Agreements

What to sign, and when.

AgreementWhen you need itHow to get it
Data processing agreement (DPA)Whenever we process personal data for you: the people your agents call or chat with, under India's DPDP Act or the GDPR.Read the commitments and request it
GDPR standard contractual clauses riderWhen personal data of people in the EU or the UK is transferred to a country outside them, including India.On request, with the DPA.
Confidentiality agreementBefore we share policies and other documents that are not public.Accepted when you request the documents.

We do not offer a business associate agreement.

Your data

How Graine handles it.

  • Processed in named places

    Our call platform runs in Mumbai, India; recordings are stored in the United Kingdom. The Trust Center names every subprocessor, what it handles and where, and says "On request" where we have not confirmed a location.

  • Encrypted in transit and at rest

    Our website, dashboard, API and call-streaming sockets use TLS 1.2 or 1.3 (older versions are refused), and browsers are told to use HTTPS only. Our providers encrypt stored data at rest.

  • Kept apart, and recorded

    Each workspace's data answers only to that workspace, and changes in your workspace are written to an append-only, hash-chained audit trail that you can verify yourself, in the dashboard or through the API.

  • Kept only as long as needed

    Call records stay for the life of your workspace unless you delete them; the audit trail keeps 400 days by default. Automatic retention settings are being built.

  • Not used to train general models

    We do not use customer conversations to train or fine-tune general AI models. See the answer below for the one exception you start yourself.

  • Breach notice

    If we confirm a personal-data breach affecting your data, we tell you within 24 hours of confirming it.

In your workspace

Controls you hold.

Each one is on the Trust Center with its status.

Your calls, your rules.

Graine gives you tools. You decide who is called and why, so the rules that apply to a call are yours to follow. We can help, but we cannot do this for you.

  • Say it is an AI, and say if the call may be recorded. An agent can open with that notice; it is built and being rolled out, and the wording is yours.
  • Honour opt-outs and keep a do-not-call list. A workspace do-not-call list is being built. Until it is live, keep and apply your own before you upload contacts.
  • In India, follow TRAI's rules for commercial calls: register with your telecom provider's DLT platform, use the number series TRAI assigns, including the 140 and 1600 series, and respect Do Not Disturb preferences. Calling hours and retry limits in Graine help; registration and consent are yours.
  • Under the DPDP Act you are the data fiduciary for the people you call and Graine is your processor: give them notice, take consent where the Act needs it, and answer their requests. We help you answer them.
  • If EU or UK personal data is involved, the GDPR applies to you. Ask for our DPA and the contractual clauses rider.

Requests and contacts

Who to write to.

Questions

Plain answers.

Are you SOC 2 certified?
No. SOC 2 is in progress: a Type I audit first, then a Type II observation period. We hold no SOC 2 report today, and nothing on this site says otherwise.
Are you ISO/IEC 27001 certified?
No. We are building our information security management system to ISO/IEC 27001:2022, and the certification audit has not been completed. We hold no certificate.
Are you GDPR compliant?
The GDPR has no certification, so we do not claim one. Where we process EU personal data for a customer we act as its processor, and we offer a data processing agreement, with a standard contractual clauses rider, on request.
Are you compliant with India's DPDP Act?
The Act has no certification either. We run a privacy program and are aligning our controls with the Act and its Rules; the Trust Center says which controls are in place and which are still being built. For the people your agents call, you are the data fiduciary and we are your processor.
Where is our data stored and processed?
Our call platform runs in Mumbai, India. Call recordings are stored in the United Kingdom, and API keys in North Virginia, United States. Where a vendor's location is not pinned in our own configuration, the subprocessor list says “On request” instead of guessing. A dedicated instance or your own infrastructure changes this for your data.
Do you train on customer data?
No. Graine does not use customer conversations, recordings or transcripts to train or fine-tune general AI models. There is one exception, and you start it: if you ask us to build a custom voice from recordings you upload, those recordings are used for that voice only. The speech and language vendors an agent uses process data under their own terms, and some run model-improvement programs of their own. For example, we have not opted out of Deepgram's. If that matters for your calls, ask us before you choose that vendor for an agent.
Which third parties handle our data?
Every subprocessor is listed with what it does, the data it handles and where, on the Trust Center. We give customers 30 days' notice before we add or replace one.
Can we run Graine on our own servers?
Yes. Graine can run on your own infrastructure: the calls, recordings and transcripts stay with you, while funding and metering still go through our hosted service. It is not an air-gapped install.
How do we get your policies and reports, or send you a questionnaire?
Ask on the Trust Center: policies and documents are shared under a non-disclosure agreement, and a draft is marked Draft. Send a questionnaire to founders@graine.ai and we answer it in writing, including where the answer is that something is not done yet.
How do I ask for access to, or deletion of, my personal data?
Use the request form in the privacy policy. We reply within 30 days and never take longer than 90. If a business called you using Graine, that business decides, and we pass your request on to it.

Running a security review?

Request our policies and documents on the Trust Center, or email your questionnaire. We answer in writing and put the engineers who built the controls on a call.

Email a questionnaire