Privacy and security, clearly explained

Where is the privacy policy? What legal bases does Graph One rely on? How do you limit what data you collect and use? Is Graph One meant for health or other sensitive data? Can Graph One hold data about someone without an account? Do you sell personal data or use it for advertising? Can people at Graph One read connected user data? Does Graph One make decisions with legal effects about people? How can someone use their privacy rights? How long does Graph One keep data? What happens when a source is removed? How does full account deletion work? When does deleted data leave backups? Can data leave the EU or EEA?

Where is production data hosted? How is data protected in transit and at rest? How are login and sessions secured? How is one user's data kept from another user? Who can join a company team in Graph One? What can teammates see about each other's networks? Can Graph One staff access production data? How do you protect staff and administrator access? How quickly do you remove staff access? How are encryption keys and service secrets handled? How is production network access limited? How do you protect against unsafe input and injection? How are uploaded archives checked? What gets logged and monitored? What do security logs contain, and how long are they kept? How is code checked before release? How do you find and handle security weaknesses? How can someone report a security issue?

Which Google permissions does Graph One request? What is the Microsoft application ID? Which Microsoft permissions does Graph One request? Why are shared Microsoft permissions listed? Does Microsoft admin consent give tenant-wide data access? Can Graph One ask for wider permissions later? What LinkedIn or X data can Graph One receive? How can a user stop access?

Do apps or AI agents get a different security model? What can a personal API key access? Can an OAuth app access everything in an account? Which OAuth scopes can Graph One apps request? What can a user control when an app connects? Which app permissions need Graph One review? How are OAuth app tokens protected? What happens when app access is cut back or removed?

What data can Graph One hold? Does Graph One read email content? What calendar data can Graph One read? Does Graph One add data from other sources? What data does Graph One send to AI services? Is connected data used to train public AI models? What product and website analytics run?

Which service providers can process data? Are connected data sources the same as sub-processors? How can a customer track provider changes? How do you check a service provider before using it? What contract terms apply to service providers? Is Graph One SOC 2 or ISO 27001 certified? Has an outside party reviewed Graph One security? What does the CASA Tier 2 review cover? Which security evidence can a customer request? Can Graph One answer a security or privacy questionnaire?

Are production databases backed up? What are the recovery targets? Do you test backups and recovery? How are bad releases handled? How does Graph One handle a security incident? When will a customer hear about a data breach? Where can a customer ask about an outage?

Who operates Graph One? Is Graph One a controller or a processor? Is a Data Processing Agreement available? Which privacy-law terms does the DPA cover? Can a business customer audit Graph One? Do you help customers with DPIAs and privacy requests? Which security and privacy policies do you maintain? How do you review security risks and controls? What security rules apply to people who work at Graph One? Which public terms apply? How can legal, privacy, or security teams reach you?