Safe to hand real work
GraphControl AI is an autonomous system that changes production data. The reason it can be trusted with that is architectural, not aspirational: a hard boundary the agent cannot cross, a human in the loop for every commit, and a governance and privacy programme around it. This page summarises the posture; the underlying policies and evidence are available to customers and partners on request.
The safety boundary
The agent can only ever wire together data and actions a developer pre-declared in the allow-list registry. Every proposed action is independently re-validated against that registry at execution time, then previewed. Nothing is committed without an explicit human confirmation. This is enforcement, not prompt instruction.
Responsible AI
Model changes pass evaluation gates before they reach production. A human stays in the loop for every state change. We do not train models on customer data without an explicit opt-in. Agent reasoning and actions are logged and reviewable in the SUPER_ADMIN console.
Security programme
ABAC role isolation (USER / ADMIN / SUPER_ADMIN) scopes every request to a tenant and its granted domains. Data is tiered across hot, warm and cold storage with encryption in transit and at rest. A SOC 2 Type II programme is in progress; the current control set and roadmap are available under NDA.
Privacy
The privacy programme is built to POPIA and the Lesotho Data Protection Act, and to the GDPR where EU customers are in scope. That covers lawful basis, data-subject requests, retention limits, breach notification, and records of processing. A Data Processing Addendum is available for enterprise customers.
Governance
GraphCenter operates as a single legal entity in South Africa / SADC, with product lines run as brands and a subsidiary-ready structure. Governance follows King IV principles: a defined delegation-of-authority matrix, a risk register, and board-level oversight of model risk and security.
Sub-processors
Core sub-processors are Anthropic and Google (model inference), Vercel (application hosting), Neon (Postgres), Upstash (queues and cache), and Hugging Face (domain adapter hosting). The current list, with locations and purpose, is provided on request and versioned in the Data Room.
Reporting a vulnerability
Email security@graphcenter.ai with details and reproduction steps. We acknowledge reports within three business days and will keep you updated through remediation. Please do not disclose publicly until a fix is released.
See also our Terms of Service and Privacy Policy. Security and compliance documentation is drafted and reviewed by qualified counsel before it is relied upon.
Powered by GraphControl