# GrantProof — Security and Data-Handling Overview

**Product:** GrantProof
**Operator:** Grant Ready Systems
**Stage:** Paid pilot
**Last reviewed:** July 15, 2026
**Security contact:** erica@grantreadysystems.com

This overview describes controls operating in GrantProof's current production-target code. It contains only verified facts about how GrantProof works today. Where a control is not yet in place, it says so plainly. It is not a third-party certification, legal opinion, audit report, or promise about controls that have not been implemented and verified.

---

## 1. Data collected & ownership
- GrantProof stores only what customers enter or upload: grant details, budgets, transactions, evidence documents and notes, deadlines, and team member names and email addresses.
- No third-party analytics, advertising, or tracking is used. No cookies are set beyond the session cookie.
- **Customers own their data.** GrantProof does not sell customer data and does not use it to train AI models.

## 2. Hosting & data location
| Component | Provider | Region |
|---|---|---|
| Application | Vercel | United States |
| Database (PostgreSQL) | Neon | United States |
| File storage | Vercel Blob (private) | United States |

## 3. Encryption and browser protections
- **In transit:** HTTPS/TLS for all traffic. HSTS is enabled to force HTTPS. Session cookies are Secure (production), HttpOnly, and SameSite-scoped.
- **At rest:** Provided by our infrastructure providers — Neon encrypts the database at rest; Vercel encrypts file storage at rest.
- The production-target application also configures Content Security Policy controls, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy.

## 4. Authentication & access control
- Email + password authentication. Passwords are hashed with **scrypt** using a per-user salt; comparisons are constant-time. Passwords are never stored or logged in plaintext.
- Sessions are server-side records bound to an organization membership, with a 30-day expiry.
- **Role-based authorization** with seven roles. Every data-mutating action is authorized on the server; UI hiding is only a convenience, never the security boundary.
- Removing or revoking a member **immediately deletes their active sessions**.
- **Not yet available:** multi-factor authentication (MFA) and single sign-on (SSO).

## 5. Tenant isolation
- Every database query and file request is scoped to the requesting user's organization in server-side code.
- Cross-organization access returns "not found" — one organization cannot read another's records.
- Isolation is enforced in application code on a **shared database** (logical isolation), not physically separate databases per customer.

## 6. File storage, access, archive & deletion
- Uploaded files are stored **privately** under random, non-guessable object names.
- Files are served only through an authenticated route that re-checks the user's session and organization on **every request**. There is no public or guessable file URL.
- Uploads use a deny-by-default allowlist and are restricted by type (PDF, Word, Excel, CSV, text, common image formats) and size (3 MB). Programs, scripts, and web/active-content files are rejected. Path traversal in file names is blocked.
- **Archive is reversible:** archived evidence is hidden from the normal binder view but its record and stored file remain available. Restore returns it as **Needs review** so it cannot silently become confirmed proof.
- **Permanent deletion is separate:** it requires explicit confirmation, removes the evidence record, disconnects optional references, and deletes the GrantProof-hosted stored file.
- Deleting a GrantProof record for an external cloud link does not delete the customer's source file in Google Drive, OneDrive, SharePoint, Dropbox, or Box.

## 7. AI data use
- The only AI feature is the optional **Readiness Assistant** (off by default; included with the single GrantProof subscription and available during the free trial; runs only on explicit user action).
- **Sent to the AI provider (OpenAI):** a scoped set of structured workspace fields — grant names, amounts, statuses, deadlines, owners, evidence titles/notes, and missing-evidence descriptions. Only authorized non-viewer roles can initiate this for customer workspaces.
- **Never sent:** raw uploaded file contents, passwords, API keys, billing data, or any other organization's data.
- Customer data is **not** used to train AI models; GrantProof does not opt in to model training. OpenAI's API terms state API data is not used to train their models.
- Uploaded document text is treated as **untrusted evidence**, never as instructions (prompt-injection defense). Every AI response carries a human-review disclaimer and cannot certify compliance.

## 8. Logging, monitoring & analytics
- Application logs are captured by the hosting platform. A redaction-aware logger removes or masks passwords and password hashes; secrets, API keys, tokens, authorization headers, and cookies; email addresses; notes, request bodies, document and extracted text; Social Security numbers; and unusually long free-text values.
- Sensitive uploaded text is never intentionally written to logs.
- No third-party analytics provider is used.
- **Not yet in place:** a dedicated third-party error-monitoring / APM subprocessor.

## 9. Certifications & compliance status
- GrantProof is **NOT** SOC 2, HIPAA, FedRAMP, ISO 27001, PCI DSS, or GDPR/CCPA certified.
- **No Business Associate Agreement (BAA) is offered. Do not upload Protected Health Information (PHI).**
- No independent third-party penetration test or security audit has been completed yet.
- Payment card data is handled entirely by **Stripe**; GrantProof never receives full card numbers (only used if you subscribe).

## 10. Data retention, deletion & recovery limitations
- Data is retained until the customer deletes it.
- Customers can **permanently delete** any individual document or **delete their entire organization and all data**. Database access is removed immediately; stored-file deletion is attempted immediately and durably retried if the provider is unavailable. Organization deletion is owner-only, requires the current password plus the exact organization name, and is blocked until Stripe confirms that any subscription is fully canceled or expired.
- Encrypted infrastructure backups held by Neon/Vercel roll off on the providers' standard schedules.
- Provider backups are not represented as an individual-file recovery service. Formal backup verification, restore testing, cancellation handling, and recovery objectives are being documented separately.
- Until those procedures are approved and tested, GrantProof does not promise a specific backup frequency, restore-test cadence, recovery time, or recovery point.

## 11. Audit logging
- High-risk actions are recorded as immutable audit events while the organization exists: evidence uploads and document deletions, document imports, member invitations/role changes/removals, settings changes, and exports.
- Audit records (actor, action, timestamp, summary) are visible to organization admins in Settings.
- Deleting an entire organization also deletes its organization-local audit history. GrantProof does not currently retain a separate surviving organization-deletion audit event.

## 12. Rate limiting & abuse controls
- Rate limiting is applied to sign-in, sign-up, invitation acceptance, uploads, and AI-processing endpoints.
- The current implementation is per-instance and in-memory — a real brake on abuse from a single source, but not a distributed guarantee.

## 13. Subprocessors
| Provider | Purpose | Data shared |
|---|---|---|
| Vercel | Hosting + private file storage | App data in transit; evidence files at rest |
| Neon | Managed PostgreSQL | All structured records |
| OpenAI | Optional Readiness Assistant | Scoped structured fields, including titles/notes (no raw file bytes or full extracted text) |
| Stripe | Subscription billing (if used) | Billing/payment details (entered with Stripe) |
| Resend | Transactional email (if used) | Recipient address + message contents |

## 14. Incident reporting
- Report security concerns or vulnerabilities to **erica@grantreadysystems.com**. We aim to acknowledge within two business days. Please do not include live customer data in reports.

---

*GrantProof is a readiness and visibility system — not a legal, accounting, audit, or compliance certification. This overview reflects controls in place as of the review date above and will be updated as controls change.*