Trust Center & Security

This Trust Center distinguishes controls that are present in the current web implementation from operational responsibilities and future assurance work. It does not claim certification or absolute security.

Secure transport

Production traffic is redirected to HTTPS and protected with HSTS.

Session protection

Authentication and antiforgery cookies use secure browser controls in production.

Access control

Protected APIs enforce authenticated organization roles and tenant boundaries.

Abuse resistance

Authentication, registration, search and governed mutations are rate limited.

Evidence transparency

Facts, interpretation, recommendations and unknowns remain visibly separated.

Browser and transport controls

The production application uses HTTPS redirection, HTTP Strict Transport Security, a Content Security Policy, clickjacking protection, MIME-sniffing protection and a restrictive browser permissions policy.

Identity and request protection

Authenticated routes require a signed-in user. Organization roles restrict viewing, contribution, approval and execution. Server-rendered forms use antiforgery validation; invalid requests fail closed without exposing internals.

Decision accountability

GetGrail keeps evidence, interpretation, recommendations, decisions, actions and outcomes distinct. Missing evidence stays explicit, and completion is not presented as a proven outcome without comparable follow-up evidence.

Scope and limitations

These are implemented application controls, not a penetration-test result, compliance certification or guarantee. Production readiness also depends on hosting configuration, secret rotation, backups, monitoring, incident response and periodic independent security review.

Production responsibility model

The application provides protective controls; the operator remains responsible for secure deployment and ongoing assurance.

Keep platform, database and dependencies patched and supported.
Store production secrets outside source control and rotate them periodically.
Test backups and restoration, not only backup creation.
Monitor availability and security events, with named incident owners.
Commission an independent security assessment before processing sensitive customer dossiers at scale.

Frequently asked questions

Is GetGrail certified?

No certification is claimed on this page. Implemented safeguards and independent assurance are deliberately presented separately.

Are scores guarantees?

No. Scores describe observed signals in a specific analysis snapshot. They are not probabilities, guarantees or external benchmarks.

What does UNKNOWN mean?

Required evidence is missing or insufficient. UNKNOWN is a prompt to investigate, never a positive or negative conclusion.

Can sensitive dossiers be used immediately?

Use a controlled pilot first. Confirm data-processing terms, retention, backups, monitoring and independent security testing before wider production use.