Architecture: security and data-handling

Where your work lives, what we do with it, how it is protected, and how it leaves — stated plainly, without euphemism. Then the self-hosted option for organisations that need it, and the doctrine that has not moved.

Where your work lives

Hosted by GRIDINT. We host the app and we host your spaces — your boards, records and files are stored and served by us, the way hosted software works. They belong to you: yours to work in, yours to export in full, at any time. Your browser still runs the board — the rendering is client-side — and the state it saves lives with us.

The board your browser runs — the demo's first sheet in the light shell: dark card faces on a light ground, each at its address — **your browser runs the board**the light shellcaptured from demo mode

The same board in the dark shell — a dark ground, light-raised faces, the same records — **the same board**the dark shell, the toggle flipped in placecaptured from demo mode

the hosted path, drawn plainly — and every arrow on it is inspectable in the request panel

What we do with it

Nothing beyond running what we host. Your work is not read for any purpose except serving it back to you, not sold, and not used to train any model. Stored by us, mined by no one is the promise on the front page, and this page is where it is spelled out.

YOUR DATA'S USES — THE ENTIRE LIST

SERVED: back to you, as your boards
SOLD: never
TRAINED ON: never

On the AI tier, your prompt and the context it needs reach our worker and the model that answers. They are not retained after the response, and the request panel shows you what was sent, every time. On AI+, your AI talks to your own provider — your prompts and completions never reach us.

ASK FOR A VIEW; GET A CARD

Type what you want to see. It arrives on the board as an element you can move, keep, and come back to — and the request panel shows you exactly what was sent, every time.

SENT: your prompt · the context it needs
SHOWN: to you, in the request panel
RETAINED: not after the response

And what stays yours to do: your data's freshness is your responsibility. You bring the data in; we do not refresh it for you. Our job is the substrate — and gold-standard surfaces on it.

THE DIVISION, PLAINLY

YOURS: the data, and how fresh it is
OURS: the substrate, and the surfaces on it

How it is protected

Hosting properly is the job, and it is assessable: spaces are separated per account; traffic runs over TLS; authentication is ours to operate, which means revocation and audit are real controls rather than promises. The application ships behind its own gates — content escaping, load-time validation, whitelisted rendering and a strict content-security policy are build requirements, not aspirations — and our setup is documented for the reviews that ask for it.

When something needs fixing, hosting is what lets us fix it once, for everyone, immediately — no stale installs, no version a security patch never reaches.

How you get it out

Export is load-bearing, not a convenience: we hand off, we do not lock in. The export is the whole space — every sheet, every record, every binding — as plain JSON your tools can read. "In full" is the point: a complete export, not a partial one.

THE EXPORT — THE WHOLE SPACE

spaces/<your-space>/
  space.json
  sheets/<sheet>.json
data/  ·  your files

plain JSON, yours to leave with — the honest half of the old promise, intact

The self-hosted option

"We cannot use vendor hosting" is where this conversation starts, not ends. For organisations with a genuine requirement — legal, forensic, regulated — the enterprise tier is the whole platform inside your own environment: licensed, deployed where your rules require it, supported under an agreement someone signs. There is no price on a page, because it is a conversation.

The tiers, including the third path → · Talk to us — hello@gridint.ai →

The doctrine that has not moved

Product law, unchanged by where the data lives.

Addresses are pointers.

Every mark lives at a cell with a name. Work can be found, referenced and commanded by address — by a hand or by a machine — because position is structure, not decoration.

Provenance rides the face.

A claim lifted from a document is born carrying its source and keeps it through every copy. Nothing arrives without a source. The board holds evidence.

The gate refuses by name.

Every incoming record is validated whole-or-refused, and every refusal carries its code, its reason and its fix — readable by an AI with no human in the loop. Reliability is not persuasion; it is a door.