Security
Safe, private, and yours
Grantary holds sensitive funder and financial information. Here’s how it’s kept safe, in plain language, including what isn’t in place yet.
Separation and access
Two simple rules sit under everything: your organization’s data is yours alone, and within your team, you decide who can do what.
Your data is yours alone
Every organization’s information is kept completely separate. No other nonprofit using Grantary can see your funders, grants, or finances, just as you can’t see theirs.
You decide who can do what
Give each person the right level of access: full control, everyday editing, or view-only. You choose who can change or remove records and who can only read them.
Enforced by the system, not by trust
These rules aren’t a setting on the surface that someone could slip past. The system applies them automatically, on every screen and every action, for everyone.
Data privacy
Your data exists to do one thing: run Grantary for you. It isn’t sold, shared with advertisers or data brokers, or repurposed. Here’s precisely who can see it.
Only the people you invite
Within your organization, records are visible only to the team members you add, at the access level you assign them. No other Grantary customer can see them.
Operator access, limited and purposeful
As the person who runs Grantary, I hold the administrative credentials needed to maintain and support the service. I use them only to keep things running or to help when you ask, never to browse, share, or sell your data.
A short, named list of providers
Your data is handled only by the vendors that make Grantary work: Supabase (database, hosting and scheduling), Vercel (application hosting), Resend (email delivery), and Stripe (billing). Each is bound by its own data-protection terms, and the full list is kept current in our Privacy Policy.
Your data stays yours
Export everything to CSV whenever you like. If you leave, you have a window of time to take your data before it’s removed, and it’s never retained to sell or repurpose. Check our Terms of Service, section 11, for more details.
Infrastructure
Grantary doesn’t reinvent security. Your data is stored and served on Supabase and Vercel, established cloud platforms that are independently audited against recognized standards.
Built on independently audited platforms
Supabase holds SOC 2 Type 2 and ISO 27001. Vercel holds SOC 2, ISO 27001 and PCI DSS. Both publish their audits, so your IT team can verify directly at supabase.com/security and security.vercel.com.
Encrypted in transit and at rest
Everything you enter is protected by TLS as it travels (the padlock in your browser) and encrypted with AES-256 while it’s stored. Sensitive items like access tokens get an additional layer of encryption on top of that.
Protected against automated attacks
Sign-in is rate-limited and shielded from bots, a standard safeguard that stops automated password-guessing, so a leaked email address on its own isn’t a way in. This is routine protection every serious app uses, not a response to any specific incident.
Safe file handling
Attach the documents you’d expect: PDF, Word, Excel, PowerPoint, CSV, plain text, and JPG or PNG images, each up to 25 MB. Other file types are turned away, so nothing harmful can slip in disguised as an attachment.
Kept up to date
Supabase and Vercel maintain and patch the infrastructure underneath, and Grantary’s own software components are updated as security fixes are released.
Not in place yet
Listed here rather than left for you to find out later, and this page will change when it lands.
Two-step login for administrators
An extra verification step for admin accounts, like the one-time codes your bank or email can use.
Questions?
I’d rather answer a specific question than have you guess from a page. Email me and I’ll walk you through exactly how your organization’s information is handled.