Your data: exporting, cancelling and deletion

Exporting

You can export at any time, including while your account is read-only.

Everything at once. An account admin can download the whole account from Account → Data export. Graften prepares one zip file in the background and emails you when it's ready; the email has no download link, so sign in to download it. The zip holds every row Graften keeps for your account (the account itself, users, clients and everything belonging to them) as CSV and as JSON, every file stored for you (reports, evidence, uploads), a manifest of what's in it, and a README. Passwords, sign-in and share-link tokens, API key hashes, signing secrets and the encrypted credentials you gave Graften for integrations are left out, because they would let the file be used to sign in; the manifest lists every column left out. An export is kept for 7 days and then deleted. You can start up to three a day, one at a time.

Individual exports:

• Risk register: Export CSV on a client's Risk Register downloads every risk for that client.
• Reports: View PDF returns the copy saved when the report was made.
• Audit logs, CSAT results and the AI Model Bill of Materials as CSV, and policies and gap reports from their own pages.

In every CSV Graften produces, a cell that starts with =, +, - or @ is prefixed with an apostrophe, so a spreadsheet shows it as text instead of running it as a formula.

When a subscription is cancelled or a trial ends

The account becomes read-only: you can sign in, view and export, but not change anything. Graften emails the billing contact the date your data will be deleted, 90 days later. Subscribing again before that date cancels the deletion.

While an account is read-only, suspended or deleted, scheduled reports don't send. Scheduled audits, dark web and vulnerability scans, health scores and uptime checks stop for a suspended or deleted account, and for a client or connection you delete.

What is deleted after 90 days

Everything that belongs to your account: clients, assets, findings, risks, policies, tickets, reports, evidence, integrations, users and every file you or Graften stored, including earlier versions of files. Your company details are removed from the account record.

Kept: billing records, as the law requires, and Graften's own audit log of account activity.

Encrypted backups of the database and stored files are kept for 35 days and then expire, so copies of deleted data are gone from backups within 35 days of the deletion.

To ask for deletion sooner, email privacy@graften.io.