Security and data protection

Separate data for every organization

Every record, document, and report belongs to one organization and is checked on every request. People only see organizations they’ve been invited to.

Strong sign-in

Passwordless sign-in with one-time email codes, plus authenticator-app two-step sign-in, required for administrators and finance roles. Sessions use secure, HTTP-only cookies.

Permissions

Role-based access controls who can change grants, record payments, see salaries, download reports, or manage documents, and these rules are enforced on our servers, not just in the screens.

Encryption

All traffic uses HTTPS. Data and files are stored on Cloudflare’s infrastructure, which encrypts them at rest; two-step sign-in secrets are additionally encrypted by Grantline-Tracking.

Safe documents

Uploaded files are checked to make sure their contents match their type; programs, macro-enabled Office files, and PDFs containing scripts are refused. Previews open in an isolated viewer.

Accountability

Changes, downloads, and report exports are logged. Payments and expenses are never edited, only reversed with a reason. Each organization’s data is backed up weekly.

Abuse protection

Rate limits, automated-attack detection, and temporary blocking protect sign-in and the rest of the platform.

Questions or a security concern? Contact us.