Architecture
Every household is its own tenant. Postgres row-level security runs on a restricted database role that cannot bypass it, and cross-household tests run in continuous integration. The audit log is append-only at the database.
Sessions
Sign-in is passwordless: a 6-digit code by email, valid 10 minutes, rate limited per email and per address. Sessions live in an httpOnly cookie behind a server proxy, so no token reaches browser JavaScript. A strict Content Security Policy with per-request nonces is applied to every response.
Data
Financial detail is encrypted at rest and redacted in logs. Uploaded documents go from the browser straight to private storage on a one-time signed link. Payment details never reach Grownz.
AI keys
Keys you supply are sealed with a server secret, never logged, and only their last 4 characters are shown. The model receives derived numbers, never your notes or documents, except a receipt you select.
What is written down
Eleven architecture decision records, a STRIDE threat model, a data-classification register, and a published OpenAPI specification live in the product repository. CodeQL and dependency updates run in CI.
Not yet
Self-serve export and deletion, malware scanning of uploads, and a public bug bounty are not yet built. Report issues to support@grownz.ai.
See the security page for the full list with file references.