Security

GrandView takes the security of your data seriously. This page describes the measures we use to protect your information.

1. Encryption

Field-Level Encryption at Rest

Every outline node, note, and draft you write is encrypted individually using AES-256-GCM before it touches our database. Not just the disk — every column of every row. Even if our database were compromised, your content would be unreadable without the encryption key.

Your outlines are encrypted before they're stored — if our database were ever exposed, your content would be unreadable. To provide features like AI assistance and sharing, our system decrypts your content when you use it.

This applies to all users automatically. There is nothing to enable or configure.

In Transit

All connections use HTTPS/TLS. HTTP requests are automatically redirected to HTTPS. HSTS is enforced with a one-year max-age.

Passwords

Stored as salted bcrypt hashes via BetterAuth. We never store or log plaintext passwords.

2. Authentication & Sessions

• Email verification required before account access
• Secure, HTTP-only session cookies with SameSite=Lax and Secure flags
• Sessions expire after 30 days with 1-day rolling refresh
• Password reset via time-limited, single-use email links
• Account lockout protection via rate limiting on login attempts

3. Security Headers

Every response from GrandView includes the following security headers:

4. API & Rate Limiting

• Rate limiting on authentication endpoints (login, signup, password reset)
• Rate limiting on AI assistance calls (daily and monthly caps)
• Rate limiting on share reactions to prevent abuse
• Server-side validation on all API inputs

5. BYOK (Bring Your Own Key)

When you provide your own API key for AI services:

• Your key is stored only in your browser's localStorage — never on our servers
• Keys are transmitted to our server only to relay your AI request, then immediately discarded
• Keys are never written to our database or logs
• You can remove your key at any time from Settings

6. AI & Transcription Data Handling

• Outline text is sent to Anthropic (Claude) for AI assistance — no personal identifiers are included
• Anthropic does not use API inputs for model training (Anthropic Privacy Policy)
• AI responses are stored in your account as assistance history — you can delete this by deleting the content or your account

7. Infrastructure

• Hosted on Fly.io with private networking and encrypted volumes
• Automated deployments via GitHub Actions CI/CD pipeline
• SQLite database with WAL mode for reliability
• Automated daily backups — backup files contain only encrypted content

8. Breach Notification

In the event of a data breach affecting your personal information, we will:

• Notify affected users via email within 72 hours of discovery
• Report to relevant authorities as required by applicable law (GDPR, CCPA)
• Provide clear information about what data was affected and recommended actions

9. Responsible Disclosure

If you discover a security vulnerability in GrandView, please report it responsibly:

• Email: contact@grandview.dev
• Subject line: "Security Vulnerability Report"
• Include steps to reproduce the vulnerability

Please do not publicly disclose the vulnerability until we have had a chance to address it. We aim to acknowledge reports within 48 hours and resolve confirmed vulnerabilities promptly.