Security

Where your data lives

Your data is stored and served in the EU (Frankfurt). The services that help run glariu are listed below.

How we protect it

• Data is encrypted at rest and in transit.
• Database rules check every request, so each person only sees what they are allowed to see, even if the app had a bug.
• Access to production systems is limited to the people who run glariu.

Private by design

• Talent reviews and succession plans are never shown to employees.
• Learning plans and private goals stay with their owner.
• Survey answers are anonymous, and groups smaller than five are hidden.
• People analytics show totals only, never single people.

Admin controls

• An audit log records admin actions such as access changes, exports and deletions. Admins can filter it and download it. Entries cannot be edited.
• Allowed email domains limit who can be invited or join.
• Data retention lets admins remove people who left, and old 1:1 notes, check-ins and survey answers, after a set time.
• An IT admin role manages accounts, invitations and security settings without seeing people data. Every access change is recorded.
• Session length signs people out a set time after they sign in.

Common security questions

Where is our data hosted?

In the EU. The app runs in Frankfurt and the database is hosted in the EU. The services we use are listed below.

Is data encrypted?

Yes. All traffic uses HTTPS, and our hosting and database providers encrypt data at rest. Keys for connected tools are also encrypted by glariu itself.

Who can see what inside our company?

Database rules check every request. Admins manage people and settings, IT admins manage accounts and security without seeing people data, and private records such as talent reviews stay hidden from employees.

How do people sign in?

Through our sign-in provider. Company single sign-on (SAML or OIDC) is in early access. Admins can sign people out a set time after they sign in.

Can our directory add and remove people?

Yes, in early access. Okta, Microsoft Entra ID and other directories can invite new people and deactivate people who leave.

Who reads the feedback people send to glariu?

Feedback sent from inside the app goes to the glariu team, who can read it across companies without the sender name. Admins in the sender company can see it with the name.

Do you keep an audit log?

Yes. Admin actions are recorded and cannot be edited. Admins and IT admins can filter the log and download it.

How long do you keep our data, and can we delete it?

You decide. Admins can remove people who left after a set time, everyone can download their own data, and deleting an account deletes its personal content.

Do you have security certifications such as SOC 2 or ISO 27001?

Not yet. We will list them here when we have them, and we are happy to answer your security questionnaire.

For anything else, email privacy@glariu.com.

Company sign-in

Single sign-on and user sync from Okta or Microsoft Entra ID are in early access. Email privacy@glariu.com to try them.

Your data, your choice

• Everyone can download their own data from Settings, My data.
• Deleting an account deletes its personal content.
• Read more in our Privacy Policy.

Services we use

Report a security issue

Found a problem? Email privacy@glariu.com. We reply as soon as we can and will not take action against good-faith reports.