Honest status. This page states what is actually implemented
today and what is not yet. We would rather under-promise. Items marked Planned
are not in place — do not represent them as complete to a buyer.
Accounts & access
Passwords are hashed with PBKDF2-HMAC-SHA256 (200,000 iterations, per-user salt). We never store or
can see your plaintext password.
Sessions use signed tokens carrying a per-account version. Changing your password or choosing "sign
out everywhere" immediately invalidates all existing sessions.
Password reset links expire in 30 minutes, work once, and the request never reveals whether an email
has an account.
Each customer's data is isolated; one account cannot read or modify another's organizations or
pipeline.
Abuse protection
Per-IP rate limiting on sign-in, sign-up, password reset, and search to blunt brute-force and abuse.
Payment webhooks are cryptographically verified (timestamp + HMAC signature); forged, replayed, or
tampered events are rejected before any account change.
Auditability
Security-relevant events — sign-ins, failed sign-ins, resets, and plan changes — are logged with time
and IP. You can review your own events inside the app.
Payments
Card data is handled entirely by Stripe. MCGrantz never sees or stores card numbers.
Data
Grant, award-history, and foundation data come from public government sources (Grants.gov,
USASpending.gov, IRS 990). See the Privacy Policy for what account data we hold.
How we reach the IRS data. Organization and foundation records come from the
IRS Exempt Organizations file, which we query through
ProPublica's
Nonprofit Explorer rather than scraping the IRS directly. It is the same underlying IRS data,
but it is a mirror, so it can lag the IRS by weeks and an organization the IRS has only just
recognised may not be there yet. That file also covers tax-exempt organizations only — a company's
EIN is a real IRS number and will still never appear in it.
Why a budget is sometimes missing. Nonprofits under $50,000 file the 990-N
postcard, which reports no financial figures at all. We can read their name, state and focus area
but there is no revenue to read, so budget-fit scoring does not apply to them. We say so rather
than showing a blank.
We do not sell data or use third-party advertising trackers.
Accessibility & hardening
The interface passes an automated Section 508 / WCAG scan (skip link, landmarks,
labelled controls, keyboard focus management, live regions). Automated scans cover
only part of WCAG; full manual conformance testing is in progress.
Security headers on every response: Content-Security-Policy, X-Frame-Options,
X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and HSTS.
Engineering practices
Automated test suite runs on every change via continuous integration.
CI blocks any commit that would include a credential or a database file.
Not yet in place (Planned)
Planned: managed database with automated backups (current builds may use a
single-instance store that resets on redeploy).
Planned: multi-factor authentication and SSO/SAML.
Planned: a signable VPAT/OpenACR — the automated scan passes, but the
manual conformance procedures (screen-reader, keyboard-only, reflow) are not yet complete.
Planned: SOC 2 and any government authorization (FedRAMP/StateRAMP) — not
started; required only for the relevant markets.
Reporting a vulnerability
Found a security issue? Please email finessehumxn@gmail.com. We appreciate
responsible disclosure and will respond promptly.