Security

• The application runs on Vercel. The database, authentication and file storage run on Supabase (PostgreSQL) in London, United Kingdom.
• All traffic uses HTTPS (TLS). Supabase encrypts the database and uploaded files at rest. The free Upstash Redis database holds short-lived rate-limit counters and does not include encryption at rest.
• Uploaded documents are kept in private storage and are downloaded through short-lived signed links.

Our Supabase Pro plan provides daily database backups retained for seven days. Uploaded documents, evidence files and logos in Supabase Storage are not included in those database backups. We do not currently promise a separate file recovery service.

• Database rules keep each workspace’s data available only to its members. These rules are enforced in the database as well as in the interface.
• Roles (admin, manager, reviewer, viewer) limit who can change records, see internal notes or manage the team.
• Administrative access is handled on the server.

Status changes for grants, milestones and payments go through database functions that check the change is allowed and write the audit record in the same transaction, so an unrecorded status change cannot happen. The activity log is append-only, and who performed an action is recorded by the server rather than supplied by the browser.

Grantees use a private link instead of an account. Each link is a random 192-bit token, expires, can be replaced or disabled by a workspace administrator at any time, and is rate-limited. The portal shows grantees only what is meant for them, never internal notes.

• Sign in with an email link or a password. Passwords are stored only as salted hashes.
• Changing an account's email or password requires a recent sign-in.
• The grantee portal and sensitive workspace actions have limits that help prevent abuse.

Pages use browser security rules that limit which scripts can run and block unwanted framing.

• Subscription payments are handled by Stripe on Stripe-hosted pages. Grantboard never receives or stores full card numbers.
• Grantboard cannot move grant funds. It has no custody of money, is not a signer on any bank account or Safe, and its optional Safe import only reads public transaction data.

Errors are reported to Sentry in the EU with personal data scrubbing enabled. Automated jobs report failures for follow-up.

If you believe you have found a security issue, email hello@grantboard.co with the details and steps to reproduce. Please do not access or change other people's data, run disruptive tests, or share the issue publicly before we have had a chance to fix it. We will acknowledge your report and keep you updated.

How we handle personal data is described in our Privacy Policy.