GradeOS.
◆ TLS · SCOPED · SIGNED
DP/00GRADEOS · DATA PROTECTION PLAIN-ENGLISH · GROUNDED IN THE SYSTEM

Your data, protected.

GradeOS grades hardware. The data we hold is your operation's evidence — device photos, measurements, grades — and our job is to make it provable to the people you choose and invisible to everyone else. This page describes how the system actually works, in plain English.

EVERY STATEMENT BELOW DESCRIBES THE RUNNING SYSTEM · COMMITMENTS ARE LABELED AS COMMITMENTS

DP/01What we collect DEVICES, NOT PEOPLE

◆ We store

  • Your account — name, email, and a bcrypt-hashed password. We never store the password itself.
  • Device evidence — grading photos of hardware, IMEI/serial, model identity, defects, confidence, grades.
  • Diagnostics — instrument readings from USB/on-device checks (battery health, lock state, sensors) with their proof blocks.
  • Bench telemetry — which station graded what, when, and how fast, so your throughput ledger works.

— We don't

  • Read or store the contents of devices you grade — grading happens from the outside: photos and instrument readings.
  • Sell or rent your data to third parties.
  • Put your operation's numbers in anyone else's view — workspace data is scoped to its owner (see DP/03).
  • Hold a plaintext password, anywhere, ever.
DP/02Where it lives ENCRYPTED AT REST
◆ Database
All operational data lives in a managed Cloud SQL (PostgreSQL) instance on Google Cloud, encrypted at rest with Google-managed keys (Cloud SQL default encryption).
◆ Device photos
Grading photos are stored as records inside that same access-controlled database — not in a public storage bucket. There is no anonymous URL that serves your photos.
◆ Application
The app runs on Google Cloud Run (us-central1). The database accepts connections from the application, not from the open internet.
◆ Secrets
Signing keys and credentials are injected as runtime configuration — they are not in the codebase and never appear in a passport, page, or PDF.
DP/03Who can see it OWNER-SCOPED BY QUERY

Access in GradeOS is not a setting that could be misconfigured per page — scoping is built into the queries themselves. Every read of devices, grades, inventory, events, and stations filters on the signed-in owner's identity at the database layer.

◆ You (operator)
A signed-in session sees only its own workspace — your devices, your grades, your benches. Requests without a valid session get a 401, not a partial view.
◆ Your benches
Grading stations authenticate with their own station token, issued at pairing — a bench can work its lane without holding your account credentials.
◆ Platform admin
Administrative endpoints sit behind a separate admin token — operator sessions cannot reach them, and admin tooling is not exposed through your workspace.
◆ Other operators
A device's cross-platform grading lifetime is visible to signed-in users with operator identities replaced by one-way hashes (e.g. op_3f9a2c1d) — the hardware's history travels with it, who graded it does not. IMEI-keyed history is never exposed to the open internet.
DP/04How it moves TLS EVERYWHERE
◆ In transit
All traffic to GradeOS is served over HTTPS with Cloud Run's managed TLS — photos, grades, and diagnostics never travel in the clear.
◆ Your session
Sign-in uses an HttpOnly, SameSite cookie (scripts on a page can't read it; cross-site requests don't carry it), with a bounded lifetime and server-side expiry.
◆ Shared passports
When you share a passport, the link carries an HMAC-SHA256-signed token minted from the device and its audit hash. The recipient sees exactly the grade evidence you shared — a forged or altered token fails verification, and your account is never exposed by the link.
◆ Verification
Anyone holding a shared passport can check it at the public /v1/verify endpoint — it confirms the signature and audit hash without requiring a login or revealing anything beyond the passport itself.
DP/05Proof, not exposure THE DESIGN PRINCIPLE

The whole point of a Device Passport is that you can hand it to a buyer and it proves condition without exposing your operation. What's inside an evidence chain is instrument data: the method that read a value, the raw measurement, and a timestamp — battery capacity=87% cycles=412, not personal content. Each grade carries an audit hash (SHA-256 of the canonical grading result), so the document you shared is the document that was graded — any alteration breaks the hash.

And because cross-operator history is keyed to the hardware with hashed operator references, a passport can show "graded 3 times, trend stable" without telling anyone who graded it, where, or what else is in anyone's inventory.

DP/06Your controls YOU DECIDE WHAT'S SHARED
◆ Sharing
Nothing is public by default. A passport becomes visible to someone else only when you mint and send its signed link.
◆ Your benches
You pair and remove stations yourself from the console; a removed bench's token stops working.
◆ Your session
Sessions expire on their own, and signing out invalidates the session server-side.
COMMITMENT — ON REQUEST, NOT A DASHBOARD BUTTON (YET)

Data deletion is available on request. Self-serve deletion isn't built yet, and we won't pretend it is — contact us from your account email and we will delete your workspace data and confirm when it's done.

Certifications, honestly: GradeOS is built with GDPR-aligned principles — data minimization, purpose-scoped access, deletion on request — but we do not hold SOC 2, ISO 27001, or GDPR certification today, and we'd rather tell you that plainly than imply otherwise. As certifications land, they'll be listed here.