Skip to content

You stay in control. Always.

Handing over your code is something we have to earn. Grace is built so you stay the decision-maker at every step, with measurable proof and guardrails you control.

You approve every PR

Grace never merges anything on its own. Every change, fix or feature, arrives as a pull request for you to review. You see the full diff, the simulated impact, and the rationale before you say yes.

Reversible by design

Because everything goes through atomic PRs, any change can be undone in one click. No irreversible moves, no silent migrations. If a fix doesn't work for you, it doesn't ship.

Proof, not promises

Grace measures the state of your app before and after each intervention, on real paths. The health score, test coverage, and resolved risks are all in numbers. You judge on facts.

Configurable controls

Access scope, the repos involved, and the level of autonomy are all adjustable. A data residency / EU hosting option is available for teams that require it.

Nothing enters your code without an explicit “yes.”

Every Grace intervention looks like a regular code review, except the work is already done, tested, and documented. You approve, you ask for an adjustment, or you decline. It's your main branch.

  • Full, readable diff, just like on GitHub
  • Impact simulation on the routes affected
  • Written rationale (the why) kept in memory
  • Rollback in one click
PR #204 · Secure /api/refund ready
app/api/refund.ts

- app.post('/api/refund', async (req, res) => {
+ app.post('/api/refund', requireSession, async (req, res) => {
    const { orderId } = req.body
+   if (order.userId !== req.user.id) return res.status(403).end()
    await refund(orderId)
  })
✓ 48 tests · ✓ lint · ✓ build · 0 regressions
AdjustApprove

Memory that belongs to you

Decisions, assumptions, and incidents are logged in a living record tied to your repo. It's your context: it stays available, exportable, and it doesn't evaporate when someone leaves the team.

Data residency

For teams that need it, an EU hosting and data-control option is available. This is about proof and configurable controls, not compliance slogans.

Trust isn't declared. It's proven.

Here is where we are on security certification, and where we're going. The audit programme starts a year from now, and that is a decision rather than an oversight: we are a small team, a full SOC 2 cycle costs five figures and months of founder time, and this year both go into the product. The controls exist now. The certificate comes when we can pay for it properly.

The windows below are counted from today rather than pinned to calendar dates: an audit slips for reasons nobody controls, and a missed date would cost more trust than it buys.

  1. Today

    Internal security practices

    Encryption at rest and in transit, key-based access, systematic code review, and no plaintext secrets in any repo.

  2. Today → T+12

    Controls first, audit later

    Security policies, access control, logging, and incident handling are written down and actually followed. They are simply not audited yet, and nothing here is presented as certified until an auditor has said so.

  3. T+12 → T+15

    SOC 2 Type I: control design

    Security policies, access control, logging, and incident management formalized. Design audited by an accredited auditor.

  4. T+15 → T+21

    SOC 2 Type II: observation window

    Controls run for six months under auditor observation. Every PR, every access, every incident documented and traceable.

  5. T+21 → T+24

    SOC 2 Type II: final report

    Full audit report, shareable with enterprise customers and prospects under NDA.

  6. T+18 → T+24

    ISO 27001: parallel preparation

    Information Security Management System put in place. SOC 2 controls cover roughly 70% of the ISO 27001 requirements, which is why the two run together.

  7. T+24

    ISO 27001: certification

    Certification audit by an accredited body. Valid for three years, with annual surveillance audits.

Beyond the programme

GDPR

In place

EU hosting and configurable data residency, available today for teams that require it.

CSA STAR

30–36 months

Cloud Security Alliance registry, for enterprise cloud buyers who ask for it.

HDS

30–36 months

French health-data hosting, if Grace takes on internal tools in the medical sector.

We publish this roadmap because transparency about what we've committed to is more honest than a badge with no context. If you have specific compliance requirements, tell us about them.

Talk compliance

Trust gets proven on your code.

Start with the free audit: you'll see exactly what Grace sees, without letting it change a thing.

Run a free audit