KIST / GOVERNANCE
How your clients' data is handled
Most vendors answer that with a policy document. This page answers it with the guards themselves, because a guard you can describe is worth more than a promise you cannot check. If you are the person your agency forwards this to, everything below is written for you.
THE CLAIM, PLAINLY
Every read is scoped to one client before it executes. A query that reaches for another client's data is refused, not quietly trimmed.
OVERSIGHT OF THE PORTFOLIO, WITHOUT SEEING ACROSS IT
Every client's data is partitioned and every read is bound to one client before it runs. Agency views give you oversight of the whole portfolio in aggregate, and they cannot surface another client's rows, because the query that would do that does not compile.
Tenant isolation
Row-level output is constrained to a single tenant structurally, in the query compiler.
WHO IS RESPONSIBLE FOR WHAT
When an agency sells Kist to their client, there are three parties and the roles matter.
The agency's client is the controller. They decide what the data is for. The agency is the processor, acting on their client's instructions. Grapeworks is the sub-processor, one hop further down, acting on the agency's documented instructions and deciding nothing about purpose.
A signed data processing agreement does not gate the first conversation or the first demonstration. It gates the first flow of client data. The connector step is where that paperwork sits, and nothing moves before it is signed.
Processor position
Your client is controller, you are processor, we are sub-processor.
WHERE THE DATA SITS
New agency clients are provisioned in the UK. Our existing estate runs on UK and European infrastructure, and we are migrating it to the same footing.
Deletion
Tenant deletion removes bronze, silver and gold together.
Governance
The questions procurement asks.
Data residency
Storage region is fixed at bucket creation and stated in the contract.
Processor position
Your client is controller, you are processor, we are sub-processor.
DPA gate
An executed DPA comes before the first data connection, not the first invoice.
Tenant isolation
Row-level output is constrained to a single tenant structurally, in the query compiler.
Raw retention
The unmodified platform response is kept, so a model change never means re-fetching.
Access
Named accounts, scoped roles, and an audit trail on every query the analyst runs.
Sub-processors
Listed, versioned, and changed on notice.
Deletion
Tenant deletion removes bronze, silver and gold together.
Portability
The modelled layer exports as open tables you can take with you.
THIS WEBSITE
Analytics on this site run on consent. Until you say yes, Google's tag sends only cookieless measurement and sets nothing. Advertising signals stay off unless you switch them on yourself, and withdrawing consent removes what was set. The detail is on the cookie policy.
WHAT WE'RE NOT CLAIMING
We're not going to tell you this is cryptographically enforced, or that mixing data is impossible by construction, or hand you a certification. What we've described above is what the code actually does, and we'd rather tell you exactly that than something that sounds more impressive and isn't precisely true.
Legal documents