Architecture
Every household is its own tenant. Postgres row-level security runs on a restricted database role that cannot bypass it, and cross-household tests run in continuous integration. The audit log is append-only at the database.
Sessions
Sign-in is passwordless: a 6-digit code by email, valid 10 minutes, rate limited per email and per address. Sessions live in an httpOnly cookie behind a server proxy, so no token reaches browser JavaScript. A strict Content Security Policy with per-request nonces is applied to every response.
Data
Financial detail is encrypted at rest and redacted in logs. Uploaded documents go from the browser straight to private storage on a one-time signed link. Payment details will never reach Grownz.
AI keys
Keys you supply are sealed with a server secret, never logged, and only their last 4 characters are shown. The model receives derived numbers, never your notes or documents, except a receipt you select.
Your data, in your hands
You can download a copy of everything your household holds and delete your account yourself, from Your data in the app. Deletion is immediate.
What is written down
Twelve architecture decision records, a STRIDE threat model, a data-classification register and an OpenAPI specification live in the product repository. The repository is private; we share the threat model and the decision records with a customer on request. CodeQL and dependency updates run in CI.
Not yet
Malware scanning of uploads and a public bug bounty are not yet built. Report issues to support@grownz.ai.
See the security page for the full list.