Security

All data stored in Benavora’s database is encrypted at rest by the underlying cloud provider using AES-256 (industry-standard symmetric encryption). In addition to the infrastructure-level encryption, every sensitive credential stored by Benavora — Google OAuth tokens, portal automation credentials, funder log-in details, and user-supplied API keys — is individually encrypted by Benavora’s application layer using AES-256-GCM before it is written to the database. This means that even a raw database read cannot expose these secrets without the corresponding application-layer key.

Encryption keys are environment variables that are never committed to source code and are rotatable without re-deploying the application. There are no hardcoded fallback secrets.

All connections between your browser and Benavora’s servers, and between Benavora’s servers and third-party APIs (Anthropic, Supabase, Stripe, Google, Resend), are encrypted with TLS 1.3 — the current best-practice version of Transport Layer Security. Older protocol versions (TLS 1.0 / 1.1) are not supported. Connections over plain HTTP are rejected or redirected to HTTPS.

Benavora is a multi-tenant SaaS platform. Every table in our database has row-level security (RLS) policies enforced by PostgreSQL at the database layer. These policies ensure that an authenticated user can only query rows that belong to their own organization — no matter what the application layer requests. An organization’s grants, applications, knowledge base entries, contacts, and credentials are invisible to all other tenants, even if a bug in the application code constructs a query without a filter.

Service-role operations (cron jobs, admin functions) use a separate key that bypasses RLS only for the specific, scoped operations that require it, and never expose data across tenants.

Benavora runs on infrastructure that has achieved or is on the path to SOC 2 certification:

• Supabase — our database and authentication provider, which is SOC 2 Type II certified. All application data, authentication sessions, and file storage run on Supabase’s US-region infrastructure.
• Vercel — our application hosting provider (SOC 2 Type II certified). Serverless functions, edge middleware, and static assets are served from Vercel’s global network.
• Stripe — payment processing (PCI DSS Level 1 certified). Benavora never stores raw card numbers.
• Anthropic — AI processing. Anthropic maintains a SOC 2 Type II report and does not use API inputs to train its models by default.

User authentication is handled by Supabase Auth, which issues short-lived JWT access tokens. Benavora enforces a four-tier role model — owner / admin / writer / viewer — and every API route validates the caller’s role before processing the request. Roles are stored server-side and cannot be self-elevated by a client request.

Webhook endpoints (Stripe, Resend) require HMAC signature verification. A request without a valid signature is rejected before any processing occurs. There is no fallback to “accept unsigned” mode.

Admin-only platform endpoints check the caller’s identity against a server-side allowlist of platform owner IDs. These endpoints are inaccessible to regular organization accounts.

Benavora does not sell, rent, or barter your personal information or your organization’s grant data to any third party for marketing, advertising, or data-broker purposes.

Data you enter — organization profiles, narratives, budgets, applications — is used solely to operate the service. When AI features process your content through the Anthropic Claude API, Anthropic’s commercial terms prohibit them from using that data to train their models.

While Benavora is primarily used by US-based nonprofits, we have designed our data practices to align with GDPR principles:

• Data minimization — we collect only what is necessary to operate the service.
• Purpose limitation — data is used only for the purpose for which it was collected.
• Right to erasure — you may request deletion of your account and associated data at any time by emailing support@benavora.com.
• Data portability — you can request an export of your organization’s data in a structured format.

Benavora stores all production data in the United States. If you require a Data Processing Agreement (DPA), contact us at the address below.

Benavora is pursuing SOC 2 Type II certification for its own operations. Our roadmap includes:

• Formal security policies and employee training program
• Automated vulnerability scanning and dependency auditing in CI/CD
• Quarterly access reviews and principle-of-least-privilege audit
• Incident response plan with defined SLAs
• Penetration testing engagement (annual)
• Third-party SOC 2 Type II audit (target: 2027)

Customers requiring a current SOC 2 report can reference the reports of our sub-processors (Supabase, Vercel) while our own certification is in progress. Contact us if your compliance team needs supporting documentation.

If you discover a security vulnerability in Benavora, please report it responsibly by emailing security@benavora.com. We will acknowledge receipt within 72 hours and work with you on a coordinated disclosure. We ask that you not publicly disclose the issue until we have had a reasonable opportunity to address it.

Security questions or data requests? security@benavora.com. General support: support@benavora.com.