Code of Business Conduct

Code of Business Conduct

1. Purpose

This code sets the standard of behaviour Graine expects of everyone who works for or with it. Graine runs voice and chat agents that talk with people on behalf of other businesses, and holds their conversations and data. Customers, the people those agents speak to, regulators and colleagues need to be able to rely on how Graine's people behave. The code says what that means in practice.

2. Scope

It applies to founders, employees, contractors, interns and anyone acting for Graine, in their work for Graine and in how they represent it. Customers' own conduct in using Graine is covered by the Acceptable Use Policy.

3. Roles and responsibilities

4. Policy statements

1. Integrity. Act honestly with customers, colleagues, vendors, investors and regulators.
2. Conflicts of interest. Declare in writing to the founders, within 30 days of it arising, any outside interest that could influence your work for Graine, such as an investment in a vendor or competitor, outside work, or a family relationship with a customer or supplier.
3. No bribery. Never offer, give, ask for or accept a bribe, kickback or improper advantage, to or from anyone, including public officials. Gifts and hospitality worth more than INR 5,000 from one source in a year must be declared to the founders.
4. Confidentiality. Protect customer data, Graine's information and other people's confidential information, during and after your work for Graine.
5. Honest claims. Never claim a certification, attestation, compliance status, customer, logo, quote or figure that is not true and evidenced. Graine states only the status it can show, with a date: SOC 2 and ISO/IEC 27001:2022 are in progress and no report or certificate is held; there is no DPDP certificate; HIPAA is not offered.
6. Fair dealing. Compete on the merits. Do not disparage competitors by name or obtain their information improperly.
7. Responsible AI. Do not build or configure an agent that deceives a person about who they are talking to where the law or the customer's rules require disclosure. Do not impersonate a real person, and do not clone a voice without the speaker's consent. Respect do-not-call wishes and calling-hour rules.
8. Data and security. Follow Graine's acceptable-usage rules for staff. Never paste credentials or customers' personal data into chats, tickets, AI tools or transcripts. Name a key; never print its value.
9. Speak up. Report concerns about security, privacy, ethics, fraud or breaking the law to the founders at founders@graine.ai. You may report without giving your name, from an address that does not identify you; Graine will not try to identify you. No one may retaliate against a person who reports in good faith.
10. Acknowledgement. Everyone acknowledges this code when they join and every year after.

5. Procedures

1. Joining. The person reads the code and acknowledges it in writing before they are given access to Graine's systems.
2. Declaring. A conflict of interest, or a gift or hospitality above the threshold in statement 3, is sent to founders@graine.ai in writing. The founders decide, record the decision and tell the person; where needed they remove the person from the decision concerned.
3. Reporting. A concern goes to founders@graine.ai. The founders acknowledge it, look into it, and keep a record that does not name the reporter unless the reporter agrees. If the concern is about a founder, it may be sent to the company's board of directors at its registered office.
4. Yearly. Everyone acknowledges the code again each year, and the founders review reports and declarations received.

6. How this is implemented at Graine (as of 3 Nov 2026)

In place. Working rules the founders already follow: no claim of a certification or attestation Graine does not hold; no invented testimonials, logos or figures; every status in Graine's documents carries its date.

Planned. Written acknowledgement of this code by everyone when they join and each year; a record of conflict-of-interest and gift declarations; the confidential reporting route described above. None has started yet; they begin now that this policy is approved (3 Nov 2026).

7. Exceptions

There are no exceptions to the rules on bribery, honest claims and confidentiality. The founders may agree, in writing, a way to manage a conflict of interest instead of ending it.

8. Enforcement

A breach may lead to disciplinary action, up to ending a person's employment or engagement, and to reporting to the authorities where the law requires.

9. Review

The founders review this code at least every 12 months, and after any serious breach.

10. Framework mapping

11. Related documents

Acceptable Use Policy · Responsible AI Statement · Privacy Notice · Vulnerability Disclosure Policy

Revision history