Security overview

In plain language

Families should understand the protections and limits of the service without needing an internal infrastructure diagram. Grace uses account permissions, family-scoped access controls, protected storage, and security records to help protect information. No online service is perfectly secure.

What we explain publicly

• Access is controlled according to account, family, role, and feature.
• Child accounts are managed by parents; sharing and parent visibility are explained in the privacy notices.
• Connections to the public website use HTTPS.
• Security records support investigation of account activity and misuse.
• Information is processed by service providers for disclosed purposes.

These are descriptions of protective measures, not guarantees of uninterrupted service or a claim of independent certification.

What stays confidential

We do not publish credentials, private service addresses, internal network topology, database structure, exact permission rules, detection thresholds, recovery procedures, or unresolved vulnerability details.

That confidentiality does not replace secure engineering or justify withholding material privacy information. The privacy policy explains information practices, and the provider disclosure identifies processing roles.

What you can do

Use a unique password, protect signed-in devices, and enable additional sign-in protections when available. Keep family membership and permissions current. Upload only information you are authorized to share and that the service needs.

Report a security concern

Use the contact form or your existing workspace support channel and identify your message as a security report. Describe the affected feature and a minimal reproduction without including passwords, access tokens, or another person’s data. Ask for a suitable private channel before sending sensitive evidence.

Do not access or retain other people’s data, disrupt the service, or carry out further testing beyond what you are authorized to do. Reporting an issue does not grant authorization for testing.

Incidents and review

If a breach affects personal information, notification obligations depend on applicable law and the incident. We will provide legally required notifications.

[Formal incident procedures, retention periods, and any additional security assurance statements remain subject to operational and legal review.]