Honest status. This page states what is actually implemented
today and what is not yet. We would rather under-promise. Items marked Planned
are not in place — do not represent them as complete to a buyer.
Accounts & access
Passwords are hashed with PBKDF2-HMAC-SHA256 (200,000 iterations, per-user salt). We never store or
can see your plaintext password.
Sessions use signed tokens carrying a per-account version. Changing your password or choosing "sign
out everywhere" immediately invalidates all existing sessions.
Password reset links expire in 30 minutes, work once, and the request never reveals whether an email
has an account.
Each customer's data is isolated; one account cannot read or modify another's organizations or
pipeline.
Abuse protection
Per-IP rate limiting on sign-in, sign-up, password reset, and search to blunt brute-force and abuse.
Payment webhooks are cryptographically verified (timestamp + HMAC signature); forged, replayed, or
tampered events are rejected before any account change.
Auditability
Security-relevant events — sign-ins, failed sign-ins, resets, and plan changes — are logged with time
and IP. You can review your own events inside the app.
Payments
Card data is handled entirely by Stripe. MCGrantz never sees or stores card numbers.
Data
Grant, award-history, and foundation data come from public government sources (Grants.gov,
USASpending.gov, IRS 990). See the Privacy Policy for what account data we hold.
We do not sell data or use third-party advertising trackers.
Accessibility & hardening
The interface passes an automated Section 508 / WCAG scan (skip link, landmarks,
labelled controls, keyboard focus management, live regions). Automated scans cover
only part of WCAG; full manual conformance testing is in progress.
Security headers on every response: Content-Security-Policy, X-Frame-Options,
X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and HSTS.
Engineering practices
Automated test suite runs on every change via continuous integration.
CI blocks any commit that would include a credential or a database file.
Not yet in place (Planned)
Planned: managed database with automated backups (current builds may use a
single-instance store that resets on redeploy).
Planned: multi-factor authentication and SSO/SAML.
Planned: a signable VPAT/OpenACR — the automated scan passes, but the
manual conformance procedures (screen-reader, keyboard-only, reflow) are not yet complete.
Planned: SOC 2 and any government authorization (FedRAMP/StateRAMP) — not
started; required only for the relevant markets.
Reporting a vulnerability
Found a security issue? Please email finessehumxn@gmail.com. We appreciate
responsible disclosure and will respond promptly.