Security

Security and hosting in India

Hosted in India, VAPT tested, and built to the same rules it checks your clients against.

A compliance tool has to practise what it checks

GRC Flow is hosted in India, in the Mumbai region. Your clients' data stays in your workspace.

VAPT tested · October 2026

Security testing: Vulnerability assessment and penetration test (VAPT) in October 2026, covering the app and this website. Every finding was fixed.
Hosting: Cloud server in Mumbai, India, served only over HTTPS. The Firm plan can also run on your own servers.
Sign-in: Hashed passwords, lockout after repeated failed attempts, secure session cookies.
Access: Admin, member and viewer roles. Evidence downloads only when signed in.
Secrets: Connector keys and AI provider keys are stored encrypted.
Connectors: Read-only by design: they collect evidence and never change your systems.
Uploads: File type checked against its content, 10 MB limit, stored under random names.
Audit trail: Every change logged in a tamper-evident chain that can be verified and exported.