Security

Where your data lives

• Lab data, accounts, and uploaded files are stored with Supabase on Amazon Web Services in the United States (US East).
• The website and app are hosted on Vercel.
• We do not store your data outside these providers, and we do not sell or share it.

Encryption

• All traffic to grantsmanager.com and app.grantsmanager.com uses HTTPS (TLS).
• The database and file storage are encrypted at rest (AES-256).
• Passwords are never stored in plain text; only a salted hash is kept.

Access control

• Each lab's records are isolated in the database with row-level security, so a user can only read and change data for labs they belong to. This is enforced by the database itself, not just by the app.
• People join a lab only by invitation, and each member has a role: Principal Investigator or Research Admin.
• Only Research Admins can approve or reject approval requests.
• Uploaded documents are kept in private storage that only members of the lab can open.
• New accounts must confirm their email address before signing in.

Operations

• Errors are monitored so problems can be found and fixed quickly.
• Code changes are reviewed and deployed through version control, with preview builds tested before release.
• Secret keys stay on the server side and are never shipped to the browser.

What we do not have yet

GrantsManager is an early product. We do not yet hold a SOC 2 report or support single sign-on (SSO). If your institution requires a security questionnaire, email us and we will complete it.

The service is not designed for classified information, controlled unclassified information (CUI), or protected health information (PHI). Do not enter those types of data.

Report a vulnerability

If you believe you have found a security issue, email hello@seaport.studio with the details and steps to reproduce it. Please do not access other users' data or disrupt the service while testing. We will acknowledge your report within 3 business days and keep you updated while we fix it.