Security
Protections built for stewardship of restricted funds
These are the controls that exist in ShulGrants today. We describe what the product does and make no certification claims.
Individual accounts only
Every person signs in with their own account. Shared logins are never issued, and each action is attributable to a person.
Authenticator-app multi-factor authentication
Access to a workspace requires a time-based code from an authenticator app in addition to a password.
Recovery codes
One-time recovery codes are issued during enrollment so a person is not locked out if a device is lost.
Role-based permissions
Roles determine what each member can see and change, including who may approve spending or manage members.
Organization-level data isolation
Each organization's records are separated at the data layer, so one workspace cannot read another's information.
Domain-based membership controls
Joining on your own requires an address on your organization's verified email domain. An owner or administrator can separately invite an outside collaborator at one exact address, and that person can never be an owner or administrator.
Administrative approval for new members
A matching email domain alone never grants access. An existing administrator must approve each request, and pending members see no organization data.
Audit history
Important administrative, approval, procurement, and financial actions are recorded with who acted and when.
Final-owner protections
The workspace cannot be left without an owner, so an organization can always recover administrative control.
Session cancellation after sensitive changes
When multi-factor settings are reset, existing sessions are cancelled so access must be re-established.
What we do not claim
- ShulGrants is not approved, certified, endorsed, or operated by FEMA or any government agency, and it is not a government system.
- ShulGrants is not a law firm, accounting firm, or grant-writing firm.
- ShulGrants does not hold SOC 2 or any other security certification, and we do not claim one.
- ShulGrants does not guarantee that a grant, reimbursement, or compliance outcome will be obtained.
ShulGrants helps organizations manage their grant processes. It does not replace the grant agreement, official program guidance, legal advice, accounting advice, or instructions from the awarding agency.