Security

How we protect your data — stated plainly, without certifications we don't have.

Encryption in transit: TLS on every connection (terminate at your reverse proxy / host).
API authentication: in hosted mode every API data endpoint requires a per-account X-API-Key (stored only as a SHA-256 hash); the Stripe webhook verifies Stripe's HMAC signature and provisions nothing without its secret.
Input validation: every endpoint validates its inputs; malformed requests get a 400, never a stack trace.
Output escaping: user content is HTML-escaped before rendering, against stored cross-site scripting.
Secrets: all credentials come from environment variables; sample configs ship as .env.example with empty values.
Backups: no automated backup is claimed for the current deploy — export your grants to CSV regularly.
Least privilege: production runs as an unprivileged user; the database directory is not web-served.

We are not SOC 2 audited and make no HIPAA-certification claims (no such software certification exists).
Where the product touches regulated data, the relevant compliance gate (e.g., signed BAAs) is completed before real data is processed — not after.

Email don+grantradar@lifeofmorr.com with "security" in the subject. We acknowledge within 2 business days.