Hosting and security posture
Our buyers vendor-review their suppliers. Publishing this plainly is part of the answer, not an afterthought.
Data isolation
GrapeBeaver is multi-tenant with row-level isolation: every record holding customer data carries an organization reference, and every query over that data is bound to a single organization through a manager that refuses to execute unscoped. A query that is not scoped raises rather than returning rows — it fails closed. Intelligence items themselves are shared platform-wide; your devices, SBOM components, portfolio matches, and personalized assessments are not.
Transport and application security
- · TLS enforced with HSTS including subdomains; secure, HTTP-only session and CSRF cookies.
- · A real Content-Security-Policy, not framework defaults — no inline scripts, no third-party script origins.
- · Rate limiting on authentication endpoints, applied in the application independent of any edge protection.
- · Argon2 password hashing; API keys stored as SHA-256 hashes and shown exactly once at creation.
- · Dependency and container scanning in CI on every change.
Data we hold
Regulatory and vulnerability data, your device and SBOM records, and account information. GrapeBeaver does not process protected health information, and no part of the product requires it.
Human review
Analysis output is reviewed and approved by a person before it is published to any subscriber. Every approval is recorded with the reviewer, the timestamp, and the agent run it approved. Assessments are AI-assisted decision support; they do not constitute a compliance determination.