Security
How Gray Office protects your data.
Tenant isolation
Every organization's data — invoices, ledger, documents, knowledge base, and integration credentials — is scoped by organization ID at the query layer and is never shared across tenants.
Access control
- Email and password authentication with optional TOTP multi-factor.
- Signed, HTTP-only session cookies.
- Role-based membership — every user's access is granted per organization.
Infrastructure
Gray Office runs on Cloudflare's network. Documents are stored in object storage and removed when you delete the record. Integration secrets are held as encrypted environment configuration, never in the database.
Reporting a vulnerability
Email security@grayoffice.app. We'll acknowledge within two business days.
Ready to hand off the busywork?
Set up your first workflow in minutes.