Security and data.
Where your data lives, how it is protected, who can reach it and how European regulation is met.
Where is my data stored?+
In a Postgres database managed by Supabase; the application is served from Vercel. Data is encrypted in transit and at rest, and Thinktier OÜ staff access is limited to what is needed. If you use AI capture, the message text is sent for extraction to Groq, Inc. (USA) or to Google. Which providers are involved, which transfers leave the EEA and under what safeguards is set out in the privacy policy.
Is it GDPR compliant?+
Thinktier OÜ is an Estonian company (Reg. 17249293, VAT EE102949399) subject to the GDPR. For the personal data your organisation keeps in Granel, such as your counterparties’ contacts, Thinktier OÜ acts as processor. The data processing agreement (DPA) is published as a draft, pending legal review, and sub-processors are listed in the privacy policy.
Who can see my organisation’s data?+
Only the users your organisation explicitly invites. Isolation is enforced per organisation with Row Level Security in the database: no user from another organisation can read or write your data, not even by mistake.
Are there role-based permissions?+
Yes, on every plan, with four roles. The owner is the only one who manages billing and changes roles. Admins invite and deactivate users, configure the organisation and can delete deals, counterparties and documents. Traders create and edit deals, counterparties, contracts, payments and documents, and can export. The viewer role reads without editing or exporting. Roles limit what each person can do, not what they can see: today every member, viewers included, can see buy prices and margins on their organisation’s deals.
Do you take backups?+
Data is hosted on Supabase (PostgreSQL) and database backups are managed by that provider. Granel does not currently offer on-demand backups or per-customer configurable retention. You can export your deals, cost lines and counterparties to CSV/Excel at any time.
Is sensitive information encrypted?+
All traffic to the platform goes over HTTPS/TLS and data at rest is encrypted at disk level by the database provider. Passwords are stored hashed and API keys with SHA-256. The secrets of the capture channels (Telegram and WhatsApp bots) never reach the browser and are read only by the service, but they are not encrypted at application level.
What happens if I stop using Granel?+
If you cancel or stop paying, the account goes read-only: nothing is deleted and you can still export deals, cost lines, counterparties and products to CSV/Excel. Attached documents are downloaded from each deal. How long each category of data is kept is set out in the retention table in the privacy policy.
Is two-factor authentication available?+
Yes. Any user can turn on 2FA with an authenticator app (TOTP) from their security settings. Today it is optional: it cannot be enforced across the organisation, and there is no single sign-on (SSO via SAML or OIDC). If your security policy requires it, we can scope it under contract on Enterprise.
Other categories
Still not sure?