Security

Last updated: 21 October 2026

How we protect the data your consortium keeps in Grantsium. This page lists what is in place today.

Where data lives

• Project data and accounts are stored in the EU (Ireland). The application runs on servers in the EU (Dublin).
• All traffic is encrypted in transit (HTTPS only, with HTTP Strict Transport Security). The providers we use are listed on the Sub-processors page.

Accounts and access

• Two-factor authentication with an authenticator app is available to every user under Account.
• Sign-up, log-in and password reset are protected by a bot check and by rate limits.
• Inside a project, each person has a role, and every item can be limited to the whole project, one organisation or named people. These checks run on our server for every request.
• The database is not reachable from the browser. Only our server can read or write it, and the database itself refuses access to everything else.
• Our internal support console requires two-factor authentication. Staff actions there are recorded in an audit log, internal notes are encrypted (AES-256-GCM), and IP addresses are kept only as irreversible keyed hashes.

In the browser

• A strict Content Security Policy limits which scripts can run, and pages cannot be embedded by other sites.
• No advertising, analytics or tracking scripts, and no third-party cookies.

Your data, your control

• You can download a copy of your account data, or delete your account, from Account at any time.
• Organisations that need it can ask for a data processing agreement (GDPR Article 28) at hello@grantsium.com.

Keeping software up to date

Dependencies are monitored for known vulnerabilities and updated promptly. Database security settings are checked against our provider’s security advisor.

Reporting a vulnerability

If you believe you have found a security issue, please email hello@grantsium.com with the details and how to reproduce it. Please do not access other people’s data or disrupt the service while testing. We will reply and keep you informed as we fix it. Our contact details are also published at /.well-known/security.txt.

Contact

Questions or requests: hello@grantsium.com