Security

Keeping organizations separate

FundMesa runs every customer organization in a shared system, and the core promise is that one organization can never read or write another's data. That promise is enforced by several independent layers, each a backstop for the one before it:

• Every database read and write is scoped to the signed-in organization at the application layer.
• Postgres row-level security is enabled and forced on every table that holds customer data, as an independent backstop — a drift guard in our test suite fails the build if a new customer-data table ships without it.
• A boot-time check refuses to start the app if its database role is able to bypass row-level security.
• File storage is authorized by an org-scoped key-prefix guard on every read, write, and delete.
• A continuous automated test probes for cross-tenant access on every change.

Access and authentication

Accounts sign in with email and password, and email verification is required. Two-factor authentication is available on every plan using any authenticator app, with single-use backup codes, and repeated failed attempts trigger an automatic lockout. We email you when your password or two-factor settings change. Inside an organization, role-based permissions (owner, coordinator, program staff, and viewer) control who can see and change what. Budget dollars are limited to coordinators, owners, a grant's assigned lead, and people given access to that grant; salary figures are a separate permission an owner grants per person. Rate limits protect sign-in, per account as well as per address, and other sensitive endpoints from abuse.

Audit logging and monitoring

Administrative actions are recorded to an append-only audit log: there is a single code path that writes to it and no code path anywhere that updates or deletes its entries. Customer-facing records carry their own activity timeline of changes. Application errors are captured by our monitoring provider with personally identifying fields, request bodies, and auth headers scrubbed in the browser before anything is sent.

The app also enforces a strict Content-Security-Policy on every page, so the browser refuses scripts and connections from sources we haven't approved, and reports anything it blocks to us for review.

Sub-processors

Operating FundMesa means routing your data through a small set of service providers, all based in the United States. We publish the complete list — with each provider's role and data region — and update it before any material change:

• Vercel — Application hosting
• Vercel Web Analytics — Cookie-free, aggregate page-view analytics for app.fundmesa.com: the page's route (query strings, fragments and record ids are removed in your browser before sending), referrer, browser, operating system, device type and country. Not used for advertising. Runs on the provider's global edge network
• Neon — Managed Postgres database
• Cloudflare R2 — File storage for your attachments
• Cloudflare Web Analytics — Cookie-free, aggregate analytics for this marketing site, fundmesa.com: page URL, referrer, browser, operating system, device type and country (derived from the IP address, which FundMesa never receives or stores). No fingerprinting or cross-site tracking; not used for advertising; not used on app.fundmesa.com. Runs on the provider's global edge network
• Resend — Transactional and reminder email
• Stripe — Subscription billing — engaged only for paying customers; card details go directly to Stripe and are never seen or stored by FundMesa
• Anthropic — Optional AI document extraction — never used to train models
• Sentry — Error monitoring (PII scrubbed before events are sent)
• GitHub Actions — Continuous integration, and a daily watchdog that reads only job-run bookkeeping to confirm scheduled jobs ran — it runs no application jobs and reads no customer records

The full, current list lives at app.fundmesa.com/sub-processors.

Reporting a vulnerability

If you believe you've found a security vulnerability, please email security@fundmesa.com with the details and how to reproduce it. We'll acknowledge your report, keep you updated as we investigate, and ask that you give us a reasonable chance to fix the issue before disclosing it publicly. We're grateful to the researchers who help keep FundMesa safe.

Our machine-readable policy is published at /.well-known/security.txt.