Security

Hosting

The application runs on Vercel. Your data and user accounts are held in a Supabase (PostgreSQL) database in the EU (Ireland).

Encryption in transit

GrapeFlow is served over HTTPS only, with HTTP Strict Transport Security, so browsers never connect to it unencrypted.

Each winery sees only its own records

GrapeFlow serves many wineries from one platform. Every table that holds a company's records is protected by database row-level security, so a query can only return rows belonging to the company the user is working in. Server-side code that runs with elevated privileges scopes every query to the company explicitly as well, rather than relying on that one layer.

Accounts and roles

• Sign-in is by email and password; passwords are stored only as hashes and must be at least 8 characters.
• A new account must confirm its email address before its first sign-in.
• Each user has a role in each company — administrator, technician or operator — and the more sensitive areas (settings, company-wide data export) are limited to administrators.

Payments

Subscriptions are billed through Stripe. Card details are entered with Stripe and never reach GrapeFlow's servers.

API keys

Keys for the integration API are shown once, when they are created; GrapeFlow stores only a hash of each key. Every key is limited to the scopes it was given, and can be revoked at any time.

Your data, on request

A company administrator can download a complete export of the company's data at any time, and you can ask us to delete your account. See the Privacy Policy.

Report a concern

If you believe you have found a security issue, or have a question about how your data is handled, email privacy@grapeflow.app.