Security & Trust

Last updated: September 2026

What is actually true about how OneGrid handles your data. Every line here describes something the product does today — not something planned.

How your data is protected

• We never store your password. Sign-in runs through Supabase Auth, which holds the credential. It never reaches OneGrid's own tables or logs.
• Card numbers never touch our servers. Every payment — subscriptions, fan payments, storefront orders — is taken on Stripe's own hosted checkout. We receive a reference to the payment, never the card.
• Row-level security is on. The database enforces who may read which rows, in the database itself, rather than trusting the application to remember. One organisation cannot read another's data even if a request asks for it directly.
• Contracts, statements and receipts live in private storage. Those buckets are not public. A document is reached through a signed link that expires; there is no guessable URL for a signed contract or a W-9.
• Fan Spotify tokens are encrypted at rest. The token a fan grants for a pre-save is sealed with AES-256-GCM before it is stored, so a copy of the database is not a set of working Spotify credentials.

Connected accounts

Meta. Connecting an ad account goes through Facebook's own login. We ask for the narrowest set of permissions the features need, we never see your Facebook password, and you can revoke OneGrid's access in one click — from your Facebook settings, or from the disconnect button inside OneGrid.

Spotify, Google, Shopify and the rest. Same shape: the provider's own login screen, scoped permissions, and a disconnect that takes effect immediately.

We store the access tokens those connections issue, never the passwords behind them.

Advertising and measurement

Public pages can load a Meta, TikTok or Google Analytics pixel so an artist can measure and retarget their own traffic. In the EU, EEA, the UK and Switzerland none of that loads until the visitor accepts it, and a decline — or simply closing the banner — means the pixel is never rendered on the page and no conversion is reported from our servers either.

What we do not do

We do not sell personal information. We do not buy fan lists. We do not use your data to train models for anyone else. We do not send fan messages on your behalf without your instruction.

Reporting a problem

If you think you have found a vulnerability, email onyx@gridlocktalent.com with enough detail to reproduce it. Please give us a reasonable window to fix it before publishing. We will not pursue anyone acting in good faith.

Where OneGrid runs

The application is hosted on Vercel; the database, authentication and file storage are Supabase. Both are in the United States. onegrid.team is the product's home.