Graphite procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ You agree that Graphite shall process data on your behalf as necessary to provide you with the Services, in accordance with our Privacy Policy , and, where applicable, the Graphite Data Processing Addendum. ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Both continuously by a suite of tools and annually by independent third-parties. Contact us to request a report.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ The Terms, together with the Orders, Data Processing Addendum available at https://graphite.com/files/DPA.pdf (“ DPA ”), and any exhibits or amendments thereto, are collectively the “ Agreement ”. In the event of a conflict between the terms of the Agreement, the following order of precedence shall apply: (a) DPA, (b) Terms, (c) Orders, (d) exhibits or amendments.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ The Services are provided from and in the United States. When you access the Services, information about you will be subject to U.S. data privacy laws.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ We are SOC2 Type II compliant. Reach out to security@graphite.dev for a copy of the audit reports.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ 5. Free Trials. You can sign up for a trial Account for the paid portion of the Services and your trial period starts on the day you create the trial Account and lasts for the duration indicated on your free trial confirmation email (or if not specified, then 30 days). If you are on a trial, you may cancel at any time until the last day of your trial by following the cancellation procedures set forth in this Section above. If you do not cancel your trial Account at the end of your free trial period, and we have notified you that your Account will be converted to a paid subscription at the end of the free trial period, you authorize us to charge your credit card or other designated billing method for continued use of the paid Services. You may, however, then cancel your subscription in accordance with this Section above. If you cancel your trial Account or decide not to purchase a paid version of the Services at the end of your trial period, your content or data associated with your trial Account will no longer be available to you, and the Company may delete or remove any such content or data in accordance with applicable Law.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Please note that any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure when it is transmitted to us. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us. Please be aware though that, despite our best efforts, no security measures are perfect or impenetrable, and we cannot guarantee “perfect security.” Any information you send us through any means is transmitted at your own risk. We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Policy. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We may obtain information about you from the following third party sources:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ To comply with applicable law or any obligations thereunder, including cooperation with law enforcement, judicial orders, and regulatory inquiries.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service providers and other similar entities: They collect information, such as your contact information, profile picture, and your affiliated company information, as applicable, on our behalf to provide our Services.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ When you request us to share certain information with third parties, such as through your use of social media widgets or login integrations.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ In connection with an asset sale, merger, bankruptcy, or other business transaction.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ With our affiliates or otherwise within our corporate group.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 9. Subcontracting. Notwithstanding the foregoing, Graphite may use the services of subcontractors and permit them to exercise the rights granted to Graphite in order to provide the Services under this Agreement. These subcontractors may include, for example, Graphite's hosting, infrastructure and CDN providers. Graphite remains responsible for compliance of any such subcontractor with the terms of this Agreement and the overall performance of the Services as required under this Agreement.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ You acknowledge that such sharing of information may occur in all of the aforementioned circumstances and is permitted by and subject to this Privacy Policy and applicable law.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Data analytics vendors;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Our Services may contain links and/or features (e.g., “like” or “share” buttons) to other websites and/or online platforms operated by third parties. We do not control such other online platforms and are not responsible for their content, their privacy policies, or their use of your information. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms (such as GitHub or Twitter) may also be viewable by other users of the Website and/or users of those third-party online platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators except as disclosed in the Services. We expressly disclaim any and all liability for the actions of third parties, including but not limited to actions relating to the use and/or disclosure of personal information by third parties. Any information submitted by you directly to these third parties is subject to that third party’s privacy policy.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Data storage providers;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Other third parties: You may choose to elect that certain third parties share information with us, for example, when you choose to access the Services through another service, such as through Single Sign-on (e.g., GitHub, GitLab, BitBucket) or link any social media platforms to your account.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ In certain circumstances, we may share information about you with third parties. Such circumstances may include:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ With professional advisors, such as auditors, law firms, or accounting firms.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ With vendors or other service providers, such as:” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ “ Orders ” means any ordering documents, online registration, order descriptions, plan selection and pricing forms and upgrades, or order confirmations (including each of the foregoing presented as pages on the Graphite Platform or as in-app notifications) relating to Customer's purchase or other use of the Services.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ 1. Service Plans. We may from time to time make the Services available through different subscription plans and/or offer multiple pricing tiers for the Services. Customer's specific plan and pricing tier for the Services will be identified in the applicable Order.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Add-Ons are available subject to the pricing set forth at https://graphite.com/pricing ;” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.