Security and responsible disclosure

• All traffic is TLS; data is encrypted at rest by our infrastructure vendors.
• Sign-in runs on Supabase Auth: OAuth (Google, Microsoft, Apple), one-time email and SMS codes, and per-organization SAML single sign-on for enterprises.
• Organization roles gate every admin surface; staff (HQ) access is separately gated and audit-logged.
• Partner API keys are stored as SHA-256 hashes and shown once at creation; webhooks are HMAC-SHA256 signed with per-organization secrets, and every delivery carries a timestamp inside the signature, so the receiving system can reject a stale or replayed one.
• Admin actions land in an audit log the organization can review.

If you believe you’ve found a security issue, email security@corporategivinghub.com with steps to reproduce. Please don’t access data that isn’t yours, and give us a reasonable window to fix before public disclosure. We aim to reply within 3 business days, and we credit researchers who help us (with permission).

corporategivinghub.com, api.corporategivinghub.com, and the partner API surface. Out of scope: volumetric denial of service, social engineering of our users, and third-party services we integrate with, sign-in among them (report those to the vendor).