Security

This page says how Granary protects what you give it: first the site as it is today, then the app, which isn't open yet, and last what isn't in place.

The site today

• The site runs on Vercel, which serves every page over HTTPS and redirects plain HTTP to it.
• The invite list is stored with Neon, which requires every connection to the database to be encrypted.
• The list holds your email address, the two optional answers and when you asked, nothing more. The form's rate limit stores a code made from your network address with a secret key, never the address itself.
• Our error logs hold no email addresses or form answers.

When the app opens

• Granary will ask the services you connect for permission to read only, so Joseph won't be able to change anything in them. Anything Granary sends out on your behalf, such as a filed return, will be a separate step that you approve in Granary.
• Each company's data will be kept apart. Your sign-in will tie every request to one company, Granary's data queries can't be built without a company, and a test with two companies will check that one can't read the other's data.
• Granary will hold the access each service gives it, encrypted and limited to reading. No other platform will hold it.
• Before a connection is switched on, it will be tested against an independent record of the same data and with the two-company test.

What isn't in place

• Granary doesn't have a SOC 2 report.
• Granary isn't an approved IRS e-file provider. Granary LLC, which will apply, hasn't been formed yet.
• Before Granary sends its first return to the IRS, it will put in place a written information security plan and the IRS's safeguarding rules for e-file providers.