Security
Mechanisms and limits, not badges
Security pages usually list logos. This one lists what the system does, where each control stops, and what we have not done yet.
Beneora holds no security certification today. We have not completed SOC 2, ISO 27001, or any equivalent audit, and we will not imply otherwise. When an audit begins we will name the framework, the auditor and the date on this page.
Last updated March 1, 2026
Tenant boundary
Isolation is a database rule, not a filter in the interface
Tenant A
Every read and write is scoped by tenant and active organization before it reaches a row.
Policy layer
Row-level policies and role checks run in the database, so a bug in a screen cannot widen access.
Tenant B
No shared cache key, no shared storage prefix, no cross-tenant search index.
Tenant isolation
Tenant and active scope are required on every read, write, cache key, background job and export. Database row-level security enforces the boundary at the data layer, not only in application code.
Limit: Under active hardening for Release 1. Verified by our own tests, not by an external audit.
Authentication
Email and Google sign-in with server-verified sessions. Roles are held in a dedicated table and checked server-side; no privilege decision is made from browser storage.
Limit: Anonymous sign-up is not offered. Enforced multi-factor authentication is Release 2.
Role and permission checks
Permissions are evaluated on the server for every mutation. A hidden interface element is never the only thing preventing an action.
Limit: Granular per-field permissions and custom role templates are not implemented.
Append-only financial audit
Posted, reconciled and verified states are server-enforced and never edited in place. Corrections create new records carrying a reason and an actor.
Limit: Implemented in the prototype's finance surfaces; enforcement moves to the server with Release 1 persistence.
Human approval on money and AI
Matching, posting and donor-visible changes require explicit human acceptance, recorded with the accepting user and timestamp. AI cannot complete these actions.
Limit: Approval thresholds are configurable per organization; there is no bypass, including for administrators.
Secret handling
Integration credentials are stored server-side, scoped to a tenant, never sent to the browser and never placed into model context.
Limit: No live third-party integration is connected yet, so this mechanism is currently unexercised in production.
Where Beneora runs
Active buildThe application is hosted on managed cloud infrastructure with a managed PostgreSQL database. Data is encrypted in transit with TLS and encrypted at rest by the platform provider.
Because the platform is pre-production, the current environment is not yet operating under a formal change-management or incident-response programme. That work is part of Release 1 readiness.
What we do not claim
- No SOC 2, ISO 27001, PCI DSS or HIPAA compliance claim.
- No end-to-end encryption claim — the application can read the data it processes.
- No penetration-test result, because no third-party test has been completed.
- No uptime guarantee. A service level commitment arrives with commercial availability.
Card data
DesignedBeneora is not a payment processor and does not intend to store card numbers. The processor boundary is designed so card data is captured by the processor and Beneora holds only references, brands and last-four digits.
No live processor is connected yet, so no card data of any kind exists in the system today.
Reporting a vulnerability
If you believe you have found a security issue, contact us through the contact page with the words “security report” in your message and enough detail to reproduce it. We will acknowledge receipt, and we will not pursue anyone acting in good faith.
We do not currently operate a paid bounty programme.
Your responsibilities
- Manage your own user list and remove access when staff leave.
- Use a unique password or Google sign-in, and keep your account recovery email current.
- Treat exported donor data as sensitive once it leaves the platform.
Something here unclear, or a claim you think we cannot support? Tell us — correcting this page is cheaper than defending it.
Design-partner program
Judge us on the mechanisms, not the marketing
We are working with a small number of US and Canadian nonprofits who feel the reconciliation and donor-data pain most acutely. Partners shape the sequence, see the honest status of every module, and are never charged for a capability that is still a prototype.
Direct answers
What reviewers ask about security
- How does Beneora keep one organization's data separate from another's?
Tenant and active organization are required on every read and write, and row-level policies plus role checks run in the database rather than in the interface. A bug in a screen therefore cannot widen access. Tenants share no cache key, no storage prefix and no search index.
See the tenant boundary- Is Beneora SOC 2 certified?
No. We hold no third-party security certification today and will not imply one. What we document here is the architecture: isolation enforced in the database, role-based permissions, audit trails on financial and receipt states, and private storage with short-lived signed access for donor documents.
Read the limits we state