Security at Grein

Your projects are private to you and the people you share them with, unless you make one public.

Everything in your projects is encrypted with AES-256 before it’s stored, backups included.

You sign in to Grein with an email and password, or with Sign in with Google. Passwords are hashed with scrypt before they are stored.

A Grein session is a short-lived access token, valid for about 15 minutes, plus a refresh token that is replaced each time it’s used. Both are kept in httpOnly cookies, which scripts on the page can’t read.

If a refresh token that has already been replaced is used again, Grein revokes that whole session and emails you a security alert.

Settings → Security lists your active sessions with the device and location of each. You can sign out any one of them, or every session other than the one you’re using.

Grein is an OAuth 2.1 authorization server for its MCP server, which is how apps like Claude, ChatGPT, Gemini and Perplexity connect to your account. Every connection must use PKCE with S256. Apps aren’t given client secrets, and a redirect URI has to match the registered one exactly.

Tokens issued to connected apps are opaque and stored hashed. An access token lasts 1 hour. A refresh token lasts 60 days and is replaced each time it’s used; if a used one is replayed, Grein revokes that app’s whole grant.

An app can ask for read access, write access or both. Your project roles still apply: if you’re a viewer on a project, an app you connect can’t edit it either. MCP tokens only work on the routes Grein’s MCP tools need, so they can’t reach your account settings.

Before an app connects, Grein shows a consent page that names the app and what it’s asking for. If Grein can’t verify who made the app, the page warns you.

Settings → Connections lists the apps connected to your account, and you can disconnect any of them there. Personal access tokens are listed in the same place. They are also stored hashed, and you can revoke any of them.

A project is private until its owner makes it public.

A public link is view-only. Anyone with it can look at the project but not change it.

People on a project are editors or viewers. Only the project’s owner can invite people, change their role or remove them.

An invite works once and expires after 7 days. It has to be accepted by the email address it was sent to.

Traffic between you and Grein is encrypted with HTTPS (TLS).

Grein’s servers are hosted by Contabo in Germany. Uploaded files are stored with Cloudflare in Western Europe.

Database backups are kept for up to 14 days.

When you delete your account, Grein soft-deletes it for 30 days. Sign back in during that time to recover it. After 30 days it’s permanently deleted.

Settings → Profile lets you download your data and choose what to include.

Grein doesn’t use your content to train its own models.

When Dia, Grein’s AI assistant, opens a link or searches the web, the page address or the search query is sent to Jina AI, which fetches the page and returns its text.

Files you upload are read by Grein’s own servers. They go to Jina AI only when Grein can’t read the file format itself, such as older .doc, .xls and .ppt files.

When Grein’s servers fetch a link, they block private and internal network addresses.

Email [email protected] or contact us through support. Tell us what you found and how to reproduce it.

The privacy policy covers what Grein collects, how long it keeps it and your rights over it.