Security at Gravicity
Your content is your business. We protect it with enterprise-grade infrastructure, encryption at every layer, and a security-first engineering culture.
Infrastructure
Built on modern cloud infrastructure with security at every layer.
Hosting
Gravity Studio is hosted on enterprise-grade cloud infrastructure in Canada, ensuring data residency compliance for Canadian organizations.
Redundant architecture with automated failover ensures high availability.
Encryption
In transit: All data encrypted with TLS 1.2 or higher. HSTS enforced across all endpoints.
At rest: AES-256 encryption for all stored data, including database contents and file uploads.
Backups
Automated daily backups with point-in-time recovery. Backups are encrypted and stored in geographically separate locations.
Backup restoration is tested regularly to ensure data recoverability.
Data Protection
Your data is isolated, access-controlled, and audit-logged.
Tenant Isolation
Each workspace operates in complete isolation. Data is logically separated at the database level, ensuring no cross-tenant data access.
Access Controls
Role-based access control (RBAC) with granular permissions. Administrators can define custom roles and control access to individual content types and operations.
Audit Logging
Every content change, login event, and administrative action is recorded in an immutable audit log. Logs include user identity, timestamp, action, and affected resources.
Authentication
Secure access with modern authentication standards.
Multi-Factor Authentication
MFA support for all accounts. Administrators can enforce MFA across their organization for an additional layer of security.
SSO Integration
Single Sign-On via SAML 2.0 and OpenID Connect. Integrate with your existing identity provider for centralized user management.
Role-Based Access
Fine-grained permissions with predefined roles (Admin, Editor, Reviewer, Viewer) and custom role creation. Principle of least privilege enforced by default.
Compliance
Our compliance posture and roadmap for industry certifications.
Full compliance with Canada's Personal Information Protection and Electronic Documents Act, including breach notification (s. 10.1), consent management, and data retention requirements.
Privacy Impact Assessments, privacy-by-default settings, cookie consent mechanisms, and data portability rights as required by Quebec's modernized privacy framework.
Data processing agreements, Standard Contractual Clauses for cross-border transfers, data subject rights fulfillment, and 72-hour breach notification for EU/EEA users.
Full compliance with Canada's Anti-Spam Legislation for all electronic communications, including express consent requirements and unsubscribe mechanisms.
Working toward SOC 2 Type II certification covering Security, Availability, and Confidentiality Trust Service Criteria. Our current security practices are aligned with the SOC 2 framework.
AI Data Handling
How we protect your data when AI features are used.
No Training on Your Data
Under our commercial API agreements with AI providers, your data is never used to train AI models. Your content remains yours.
Encrypted Processing
All data sent to AI providers is encrypted in transit. We use only providers with enterprise-grade data processing agreements and security certifications.
Responsible Disclosure
We take security vulnerabilities seriously. If you discover a potential security issue in Gravity Studio, we encourage you to report it responsibly.
Report a Vulnerability
Please email our security team with details of the vulnerability. Include steps to reproduce, potential impact, and any suggested fixes.
security@gravicity.ioWe will acknowledge receipt within 48 hours and aim to provide an initial assessment within 5 business days. We will not take legal action against researchers who report vulnerabilities in good faith and follow responsible disclosure practices.
Have Security Questions?
Our team is available to discuss your security requirements, provide compliance documentation, or answer questions about our security practices.
Contact Us