Gradii Trust Vault: Security you can read for yourself.

Gradii is a Data Processor for employers and a Data Fiduciary for its own customers. We're implementing the Rules' obligations now, ahead of their May 2027 commencement.

• Consent recorded before any background check; DigiLocker for documents
• Grievance Officer published; 30-day response to rights requests
• Board intimation without delay, detailed report within 72 hours
• Retention limits enforced by scheduled deletion jobs

Article 28 Data Processing Addendum with the 2021 Standard Contractual Clauses (Module Two) and UK Addendum, a processor ROPA, and a DPIA for biometrics.

• Art. 28 DPA with SCCs and UK IDTA Addendum
• Art. 9 biometrics: DPIA completed; explicit-consent step in progress
• Art. 22 automated decisions: disclosed, reversible, human-review mode in progress
• Controller breach notice within 48 hours

Six-hour incident reporting is built into our incident response plan. 180-day log retention and NIC/NPL time sync are being rolled out on our servers.

• 6-hour reporting in the incident response plan
• Security audit log kept 365 days
• 180-day web-server log retention: rolling out
• NIC/NPL NTP servers: rolling out

We haven't completed a SOC 2 audit. Our controls and policies are written against the Trust Services Criteria, and evidence collection has started.

• Policies mapped to Security, Availability, Confidentiality and Privacy
• Pre-answered security questionnaire available under NDA
• Readiness assessment: planned

We use ISO 27001's Annex A as our control baseline: policies, access control, operations, incident management and supplier security. We aren't certified.

• A.5 policies, reviewed annually
• A.5.15–5.18 access control, reviewed quarterly
• A.5.24–5.28 incident management playbooks
• A.5.19–5.22 supplier security register