How GrantCue protects your grant data

Traffic between your browser and GrantCue uses TLS, and the site tells browsers to use HTTPS only. The database and file storage run on Supabase, which encrypts stored data at rest. On top of that, GrantCue encrypts the secrets it keeps for you with AES-256-GCM before they are saved: the tokens for connected apps such as Slack and Google Drive, webhook signing secrets and two-factor secrets. Only the server can read them back.

Each organization's records are separated by row-level security rules inside the Postgres database, not only by checks in the app. The database compares every query with the signed-in user's organization and role. A request sent straight to the database API instead of through GrantCue's pages is held to the same rules.

Anyone can turn on two-factor sign-in with an authenticator app and get 10 single-use recovery codes. An organization admin can require it for admins or for every member. A trusted device skips the prompt for 30 days. Where an organization requires it, the database refuses a session that has not passed the second factor, so skipping the app does not skip the check. Five wrong codes lock the account out for 15 minutes.

Every member has a role that decides what they can see and change. The Organization plan adds custom roles and an audit trail of status and deadline changes, so you can see who changed what and when. Integration credentials and webhook secrets are readable by the server only, never by the browser.

Sign-in and two-factor endpoints allow 10 requests a minute from one address, and routes that send email or call an AI model have daily limits per user. The counts live in the database. If the limiter cannot reach it, a request that writes, sends email or calls a model is refused instead of being let through uncounted; plain reads fall back to a per-server count.

Every page is sent with a Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, frame restrictions and a referrer and permissions policy. Cross-origin requests to the API are refused unless they come from a GrantCue site. A stricter Content-Security-Policy without inline scripts is running in report-only mode: it reports what it would block, and it is not yet enforced.