Last reviewed: October 13, 2026
Data privacy and security are part of how The Grovery designs software, evaluates technology, and delivers client work.
We apply administrative and technical safeguards designed to protect confidential information against unauthorized access, use, disclosure, alteration, or loss. Our approach considers the sensitivity of the data, its intended use, and the requirements of each engagement.
This page describes our approach to client data across our services and software platforms, including Personafi and BrandPulse. It complements our Privacy Policy, Terms of Service, and applicable client agreements.
We use confidential client data to provide the services and platform functionality agreed with the client.
Before receiving sensitive datasets, we establish the intended use, appropriate transfer method, access requirements, and any project-specific restrictions. We request only the information needed for the work and favor aggregated or de-identified information where practical.
Confidential client data is not sold, pooled across clients, or used for unrelated engagements. Access to information for one project does not authorize its use in another.
Sensitive datasets are transferred through an agreed secure channel, such as SFTP, our secure upload portal, or a client-approved platform. Clients should use that channel rather than send sensitive datasets as ordinary email attachments.
We use encrypted connections to protect data in transit and private, access-controlled storage with encryption at rest. Depending on the service or engagement, our infrastructure may include AWS, Netlify, and Supabase.
Storage permissions and application access controls are configured to restrict access to authorized users and services. We review these configurations as part of our software and infrastructure security practices.
Access to confidential client information is limited to authorized personnel and services with a legitimate need to support the engagement.
We follow the principle of least privilege: access is limited to what a person or service needs to perform its function. Administrative access is restricted, permissions are reviewed as responsibilities change, and access is removed when no longer required.
Within our platforms, project and account permissions are used to keep confidential client information separated from unrelated users and engagements. Applicable platform and infrastructure logs support oversight and investigation.
We review the software we build and the tools we use for their security implications throughout development and ongoing operation.
Our reviews address:
We follow relevant provider security guidance and established secure development practices. Identified issues are evaluated and addressed according to their severity, potential impact, and the sensitivity of the affected information.
We revisit these practices as our platforms, integrations, and client requirements evolve.
Personafi, BrandPulse, and certain client services may use AI to support analysis, persona interactions, and other agreed functionality.
We limit the confidential client information sent to AI services to what is needed for the intended purpose. We use approved business or API services whose applicable terms exclude client inputs and outputs from model training.
We do not use confidential client data to train or fine-tune AI models. Providing information as context for an authorized analysis or persona interaction is distinct from training the underlying model.
Our evaluation of AI services includes their data-use terms, retention practices, and available security controls. Restrictions on AI processing are addressed before confidential data is used in the relevant workflow.
Cloud infrastructure, software providers, and specialist data partners may support an engagement. We review their role, relevant security practices, and data-handling terms before using them with confidential client information.
Providers that store or process information on our behalf are sometimes referred to as subprocessors. Relevant provider information is available as part of a client security review.
A partner supplying licensed research or market data does not automatically receive access to client-provided information. Sharing confidential client data with a specialist partner requires authorization within the engagement and appropriate confidentiality and data-handling terms.
Retention requirements reflect the purpose and duration of the service.
For ongoing platform engagements, information may be retained to support authorized functionality, project history, and continued access. For time-limited projects, source datasets and working materials are retained according to the agreed project schedule.
At the end of an engagement or applicable retention period, we return or delete client information according to the agreement. Retention arrangements address deliverables, backups, provider-held copies, and records that must be maintained for contractual or legal purposes.
Written confirmation of completed deletion actions is available on request.
Information requiring additional safeguards must be reviewed before it is shared with us. This includes identifiable patient information and other regulated or particularly sensitive personal data.
We work with clients to determine whether the proposed platform, configuration, providers, and agreements are appropriate for the intended use. Clients should not upload such information until the required arrangements have been agreed in writing.
Infrastructure providers we use, including AWS, Netlify, and Supabase, maintain independent SOC 2 Type II audit reports covering their respective services and controls.
The Grovery has not undergone an independent SOC 2 audit. Provider assurance supports our infrastructure selection; we remain responsible for our own application configurations, access controls, and data-handling practices.
We can direct clients to relevant provider security and compliance documentation during a vendor review.
If we become aware of a security incident affecting confidential client data, we take steps to investigate, contain the issue, and address its cause.
Affected clients are notified without undue delay, consistent with applicable contractual and legal requirements. We share available information about the incident, provide updates as material facts become known, and document corrective actions.
We welcome security discussions before an engagement begins or confidential information is transferred.
We work with clients on vendor security questionnaires, confidentiality requirements, Data Processing Agreements, and project-specific safeguards. Requirements for a particular engagement or platform deployment are documented in the applicable agreement.
This page provides a general description of our approach. Specific service commitments and responsibilities are set out in the applicable client agreement.
For security questions, secure-transfer arrangements, provider information, or suspected security issues, contact hello@thegrovery.com.
Please do not include sensitive datasets, passwords, or API credentials in your initial email.