Trust & Security

Greyrox is hosted entirely within the EU. Data about the AI tools and agents Greyrox identifies in your company — and everything derived from it, including audit logs and cost data — is stored and processed on EU infrastructure. It does not leave the EU as part of how Greyrox operates.

No third party subprocesses the customer data that runs through the Greyrox platform — the tool inventory, permissions, audit logs, and cost data described elsewhere on this site stay inside infrastructure we operate ourselves.

This is separate from the service that supports the sales process itself — Calendly, for booking a demo — which is covered in our Privacy Policy, since it only ever sees what you choose to share with us directly, not your company's AI usage data.

Data is encrypted both in transit and at rest, throughout the platform.

We retain inventory, permissions and audit data for six months. If you ask us to delete it sooner — for a specific record, or on offboarding — we do that on request rather than waiting out the six months.

Our SOC 2 Type 1 audit is in progress. We'll update this page — and tell existing customers directly — once it's complete. If you need our current audit status or documentation for a procurement review in the meantime, ask us and we'll share where things stand.

We maintain an incident response process with a defined SLA, and notify affected customers without undue delay if something goes wrong — in line with the GDPR's own 72-hour requirement for notifying regulators of a personal data breach.

Sign-in. Users sign in with a password and an authenticator code, or with a passkey. There is no SMS option, deliberately: a code sent to a phone number can be taken with the number.

Who can do what. Authority to create and approve policies, workflows and agents is assigned explicitly, per workspace. A new team member starts with no roles, and nothing is assumed from a job title.

Records. Greyrox keeps an audit trail of what ran, who approved it and when, under the retention described above.

The company. Greyrox B.V., IJsbaanpad 2, 1076 CV Amsterdam, the Netherlands. KvK 77254171.

If your procurement process needs something not covered here, such as a data processing agreement, a security questionnaire or our SOC 2 status, email info@greyrox.com and tell us what it needs. We'll tell you plainly what we can provide today.