IT FAQ

The local Grunt add-in reads the selected or previously linked Excel ranges needed to create and refresh Grunt objects. Standard Excel/PowerPoint functionality processes workbook contents locally. Optional AI and Content Distribution features have separate data handling, described below. See our data policy for details.

The add-in is not restricted to the active workbook. It can list open workbooks so you can select a data source, and reads the selected or previously linked ranges needed to create or refresh Grunt objects. It can also open a linked workbook when required for a refresh.

Yes. The desktop add-in can read linked or user-selected files on network drives and shared folders, subject to your existing Windows and network permissions.

Yes, when you use the Microsoft 365 integration. The add-in can read selected ranges from SharePoint and OneDrive workbooks through Microsoft Graph using your delegated Files.Read permission. Access occurs in response to your actions; files are not browsed or scanned in the background.

For standard Excel/PowerPoint functionality, workbook contents are not sent to or stored in Grunt's cloud services. When you enable and use AI functionality, relevant content is sent through Grunt's AI service for processing. Grunt's Content Distribution feature also stores content explicitly published for distribution in Grunt's private cloud, or in your own Azure environment for self-hosted deployments.

Grunt uses OpenAI's GPT models. We are moving to OpenAI models hosted on Microsoft Azure. The specific model version may change as the functionality develops.

Yes, but only when you enable and use AI functionality. Content needed to fulfil your request is sent to the model provider through Grunt's AI service.

Content submitted to AI functionality is retained on Grunt's servers only for as long as necessary to deliver the requested output, then deleted. AI conversation history is stored locally on your device to support continued conversations and can be deleted by you. Retention by the model provider is governed by the applicable service agreement and configuration.

No. Customer content submitted to AI functionality is not used to train AI models, and our subprocessors are prohibited from using customer data for model training.

Yes. We process name and email addresses in order to grant licenses to users of our software. These licenses are linked to an email address. In addition, we register telephone numbers for a small number of contact persons, for example for inquiries related to technical questions, invoices, or user administration.

Grunt's cloud services retain and process data in Northern Europe on Microsoft Azure. We are migrating AI functionality to Azure-hosted OpenAI models, with EU processing as a requirement of that deployment. The migration is in progress.

Account and subscription data is retained for as long as the subscription is valid, and for a period after to allow for resubscription or other inquiries (normally 1 year). Data may be stored longer if required to comply with applicable laws or regulatory requirements. AI content and local conversation history are covered in the AI retention answer above.

Grunt is a SaaS offering, but it is primarily an on-premise installation running locally on the user's computer. We have a cloud infrastructure that is primarily used to validate user licenses and for certain optional add-on functionalities.

The data centers used are Microsoft Azure, which are designed to meet or exceed Tier III standards and, in some cases, align with Tier IV standards for regions with Availability Zones.

Grunt-operated cloud infrastructure is shared with other customers and supports licensing and optional services such as AI and Content Distribution. The data handled depends on the features you use, as described above. For self-hosted Content Distribution, distributed content resides in your own Azure environment.

Yes. We use third-party subprocessors. The current list is maintained in our Trust Center. Click Overview and scroll down to the subprocessor list.

All software is digitally signed with an Extended Validation (EV) code-signing certificate.

Yes. The automatic updater verifies downloaded installer and updater packages against their expected SHA-256 checksums before proceeding. If a checksum does not match, the update does not proceed.

For the default per-user installation, updates normally run without elevated privileges. A per-machine installation under Program Files requires administrator rights and has automatic updates disabled by design; updates are then distributed by IT through its deployment tooling. See update management for details.

Yes. The release process validates digital signatures on packaged executables and libraries, and the automatic updater checks downloaded package integrity using SHA-256 checksums.

Our CTO is responsible for information security in the company.

Yes. We have established a management system for information security based on the requirements of the ISO 27001 standard. This includes policies, risk management, security controls, role and responsibility distribution, training, incident management, monitoring, and documentation.

Yes. Our application is built for customers with high security requirements, working with sensitive information related to banking, finance, and M&A. We work continuously with risk assessment through both internal and external evaluations.

Yes. Security assessments are an important part of our development criteria. If potential challenges are reported internally or externally, a team is appointed to analyze the situation, draw up a mitigation plan, and implement a solution. This work is prioritized over other development to ensure the shortest possible response time.

Yes. We have clearly defined routines for handling information security in project work, along with routine evaluation of our systems including periodic external evaluation when necessary.

Yes.

Our security policies are reviewed twice a year, or following any material change to our business.

We use AES-256 encryption for securing data at rest and in transit. Data in transit is encrypted using TLS 1.2/1.3. Encryption keys are securely managed using Azure Key Vault, and key lengths comply with minimum cipher strength requirements.

Our network defenses include firewalls, anti-malware solutions, application whitelisting, intrusion prevention systems (IPS), and two-factor authentication for secure access. Our cloud infrastructure (Microsoft Azure) provides built-in DDoS protection as part of its security services.

Yes. We conduct regular external penetration tests. Identified vulnerabilities are tracked and remediated through our standard vulnerability management process.

We have automatic scans checking for issues with the code or dependencies as part of our development process. We have also verified with external independent technical auditors that there are no obvious issues with data communication.

Yes. We handle security incidents through established routines for reporting and follow-up. Customers who are affected by security incidents are followed up in accordance with our guidelines for incident reporting. If a breach requires notification to the Norwegian Data Protection Authority, they will also be notified.

Yes. Notification routines and deadlines are normally agreed through data processing agreements and/or in an appendix to the customer agreement.

Yes. The customer can access security logs provided this does not compromise other customers or create a security risk for our systems. In such cases, we will work with the customer on a cost/benefit assessment and clean system logs of sensitive information.

Yes. See our SSO documentation for details.

We sign all software with an EV certificate, so Defender exclusions are generally not needed. That said, we recommend adding a Defender exception for our auto-update mechanism to ensure it runs smoothly. See network and security for details.

We carry out assessments of candidates' suitability to comply with our security requirements. Employment contracts define confidentiality clauses and guidelines, and security training is an important part of onboarding for employees with system access. When a person leaves, all access to systems is withdrawn before the person departs.

Yes. A security training and awareness program is in place for all employees, including new hires, permanent, temporary, and contract staff. New hires undergo training during onboarding, and all employees receive yearly updates to stay informed about security best practices and policies.

We have established routines for access control to systems and data. We operate according to the principle of least privilege, where employees are only granted rights required for their current role. Access rights are revised annually and continuously adjusted as needed.

Work with data and systems is not based on local settings or physical machines. Access to mobile devices does not give third parties access to our systems.

Yes. This information is logged.

Employees do not have access to customer systems. To the extent that employees have access to customer information, this is access controlled and documented.

Yes. This can be delivered on request.

Yes. Our operating model documents how system development is carried out and which guidelines exist.

Yes. Change management follows our standard development process and operating model.

Yes. We have templates and processes for reporting event logs to our customers.

Yes. We have several layers of backup of both system code and other necessary information, such as license information needed for user access.

We prefer to roll forward with a quick hotfix rather than roll back, because files and presentations users have touched on the new version may not be fully compatible with an older one.

• For minor version updates, rollback is possible.
• For major version updates, staying on the Stable channel and waiting for a hotfix is preferable.

Large organizations should stay on the Stable release channel and use a managed rollout so new functionality is validated before it reaches all users. See update management for details.

Yes. System code is restored from backup daily as part of our development model. Other information is tested periodically.

Yes. We have built-in logging and monitoring of our systems. These logs can be configured by the customer's IT department.

Information is always encrypted in transit through industry standards (SSL/TLS) for data transfer between systems and in communication with customers and subcontractors. Encryption at rest is implemented where critical to protect sensitive information.

Yes. We have documented continuity plans that ensure our services can be maintained or quickly restored in the event of unforeseen events. These plans include procedures for disaster recovery, resource allocation, and communication with affected parties.

The plans are reviewed and revised annually.

Yes. We follow best practices for secure software development. The development model is documented in our system development process.

Yes. We have thorough reviews with our suppliers when entering into new agreements. For the most important subcontractors we have regular contact and follow-up, with a minimum of annual contact with all suppliers.

Yes. We continuously incorporate customer requirements in our dialogue with suppliers and annually revise contracts based on any need for changes.

Yes. The service requires API calls for functions such as license validation. All API calls are authenticated and encrypted.

Yes. Role-based access is supported for managing users and licenses.

Our APIs are REST based.

Yes. We use SonarCloud as our SAST tool and rely on multiple Roslyn Analyzers to continuously automate code analysis during development.

The company is fully equipped to operate independently of our offices and can move operations to other suitable premises, with home office as an immediate temporary solution.

Yes. The company does not use physical storage media on its own premises. We have routines for deleting data from servers operated by subcontractors.

You can appoint one or more license managers who handle licenses online. Licenses are assigned to users and can be used on several machines as long as it is the same user. You can add, remove, or re-allocate licenses at any time and the update takes place immediately.

Licenses are linked to user email addresses. Users log in with their email address in Grunt within PowerPoint, and validation is done against our license server. The license is validated regularly but is not required at each startup, so users can work offline (for example on flights or short travel).

If you use proxy servers that filter web traffic, our license server must be whitelisted so licenses can be validated. See network and security for the required endpoints.

Yes. We support centralized distribution, used today at banks and other organizations with high security requirements.

Managed deployment:

• MSI file is distributed to your IT team
• Installation can be automated using common tools and configured with command line arguments
• Grunt is installed to Program Files
• Updates are distributed to your IT team according to your agreement (typically monthly or every other month)
• Users can see that new versions are available but cannot upgrade themselves

Standard deployment (used by most customers):

• Installation from MSI file (from IT or by the user manually)
• Grunt is installed without administrative rights to the user's AppData folder
• New updates are made available online and the user is offered to update the next time they open PowerPoint
• The upgrade completes within 15 seconds
• New versions are normally available once a month

See deployment and installation and update management for full details.

A tenant is your organization's Grunt account — the top-level entity where users and licenses are managed. When IT asks about "setting up a tenant," this means creating an organizational account, signing a contract, and getting a login where license managers can add users.

The Content Library is the top-level feature that provides access to both the Grunt Library (built-in templates and assets) and Content Distribution (your organization's shared templates, logos, and images). In the Grunt ribbon, this appears as Library.

32-bit support is being phased out. The 32-bit installer has been removed from the main download page. Organizations still requiring a 32-bit build for exceptional cases can contact support for a direct download link to the current stable 32-bit release. Once the migration to .NET 9 is complete, 32-bit support will be fully discontinued.

Grunt does use additional memory while running as a COM add-in. The increase is modest under normal use. If you observe significant RAM increases (e.g., PowerPoint memory doubling or more), this may indicate an issue — contact support with your Grunt version, number of objects in the presentation, and system specifications.

Yes. Grunt is ISO/IEC 27001 certified. You can view our certification and security documentation in the Grunt Trust Center.

We follow the regulations applicable to the business based on the geographical areas we operate in. As a Norwegian company, we comply with Norwegian laws and norms for good business practice.

Yes. We have routines for notification of deviations to the Norwegian Data Protection Authority in accordance with applicable regulations.

Yes. We give clients the opportunity to carry out independent audits of our information security and assist with external audits as required. The frequency and scope of audits is assessed on a business basis.