GraphJSON stores product, operational, and business events on behalf of customers. This page states the controls and limitations GraphJSON currently publishes so security reviews can distinguish verified behavior from assumptions.
Last reviewed July 2026.
Architecture and data location
GraphJSON runs on Google Cloud Platform in the United States. Firebase provides account authentication and account metadata; event data is stored in ClickHouse for analytical queries. GraphJSON does not currently publish a customer-selectable data region.
Service data is backed up for recovery after an infrastructure failure. Operational backups are not a customer-selectable archive, version history, or guaranteed undo mechanism for an intentional collection deletion.
Production infrastructure access is limited to GraphJSON maintainers and uses key-based authentication. Operating-system and dependency updates are applied as part of service operation.
Encryption and transport
GraphJSON application, API, and embed traffic is served over HTTPS. Customers should never send events over an unencrypted connection or place a GraphJSON API key in a URL.
GraphJSON does not currently publish a detailed customer-facing specification for every category of encryption at rest, customer-managed encryption keys, or key-rotation intervals. Do not claim those controls in a vendor review without a current written commitment from GraphJSON.
Account and API access
Dashboard accounts use password authentication through Firebase and support SMS-based two-factor authentication. Use an individual login for each team member and review access whenever roles change.
Event ingestion and data APIs use one workspace-scoped GraphJSON API key. The key can write events and request workspace data or generated embeds. It is not a public browser key or a collection-scoped read-only credential.
- store it in a server-side secret manager or environment variable
- never commit it to source control
- never place it in browser or mobile application code
- inventory every server, worker, and provider integration that holds it
- contact GraphJSON immediately if it may have been exposed
The account security and recovery guide covers passwords, two-factor authentication, lost-phone recovery, sessions, and offboarding. The API key security guide covers application deployment patterns and credential exposure.
Data minimization and privacy
Customers decide which event properties to send. Do not log passwords, reset links, session tokens, API keys, authorization headers, payment-card data, private keys, or complete private documents. Prefer stable internal identifiers over names and email addresses.
Customers can configure collection retention, export supported Samples and analytical results, delete collections, and clear workspace events. GraphJSON does not currently document a self-service whole-workspace raw archive or row-level deletion API.
Review data lifecycle and privacy and export and deletion behavior before depending on GraphJSON for a specific archival or privacy-request workflow.
Customer data is not sold. GraphJSON maintainers access private customer data only when required to operate the service, investigate an incident, or resolve a support request.
Embedded analytics
Generated embed URLs contain encrypted query configurations, but they function as bearer capabilities: anyone who obtains a URL can load that configured result.
For customer-specific analytics, your server must authenticate the viewer, derive the authorized account or user ID, add a fixed tenant filter, call GraphJSON with the workspace key, and return only the generated URL. Never accept arbitrary SQL or filters from a browser and append the key.
Use the production embedding checklist before launch.
Shared responsibility
GraphJSON operates the hosted application, authenticated product surfaces, workspace data boundary, retention controls, and documented API. Customers remain responsible for:
- deciding what data is appropriate to send
- protecting account credentials and API keys
- authorizing end users before generating personalized results
- choosing retention and preserving required archives
- securing exports and generated embed URLs
- monitoring producer queues, retries, and reconciliation
- removing former team members and rotating exposed customer credentials
The complete matrix is in Security review and shared responsibility.
Service providers and assurance
GraphJSON uses infrastructure, authentication, analytical storage, billing, email, and SMS services to operate the product. This page is not a complete contractual subprocessor register. Organizations requiring a current subprocessor schedule, data-processing addendum, or provider change notifications should contact GraphJSON before sending regulated data.
GraphJSON does not currently claim a public SOC 2 report, ISO 27001 certification, HIPAA business associate agreement, PCI service-provider attestation, external penetration-test report, availability SLA, or recovery-time/recovery-point objective.
Absence of a claim means it is not publicly committed. Contact GraphJSON before procurement or a regulated deployment depends on it.
Availability and incidents
GraphJSON does not currently publish an automated status feed or customer availability SLA. Applications should keep analytics off the critical transaction path, queue important events, use bounded retries, and show unavailable embeds separately from empty results.
Read Service status and incident communication for the reporting and recovery workflow.
Report a vulnerability or incident
If you believe you found a vulnerability, exposed a GraphJSON credential, or observed a possible service incident, email hi@graphjson.com.
Include the affected URL or workspace, approximate time and time zone, a concise description, and safe reproduction steps. Do not include active secrets, complete customer payloads, SMS codes, or unrelated private data.
GraphJSON does not currently publish a public bug-bounty program or vulnerability-response SLA.
For legal terms and data-use details, see the Privacy Policy and Terms of Service.