Skip to content

Granel

Commodity OS

Security

How Granel protects your desk’s data

Last updated: 29 September 2026

This page describes the measures Granel has in place today, as they stand in the code. It does not mention certifications, server locations or availability commitments: if your evaluation needs them, ask us and we will tell you what exists and what does not.

What the product does not do yet — corporate SSO, organisation-wide mandatory second factor, field-level permissions — is listed in what Granel does and doesn’t do.

Isolation by organisation

Every row of business data carries its organisation’s identifier, and the database (PostgreSQL) applies row-level security policies to every query: a user can only read and write their own organisation’s rows. The rule lives in the database, not only in the application, so it also holds if someone queries the data API directly.

A deactivated user loses access, and the same policies apply to requests made with an API key.

Roles and permissions

  • Owner: everything an admin can do and, exclusively, billing and role changes.
  • Admin: manages the team, settings and API keys; can delete deals.
  • Trader: creates and edits deals, counterparties, contracts, payments and claims, and exports.
  • Viewer: read-only; cannot create, edit or export.

Roles govern what each person can do, not what they can see: every member of an organisation, a viewer included, sees the same deals with their purchase prices and margins. There are no field-level permissions today.

Sign-in and second factor

  • Users sign in with email and password or with a Google or Microsoft account.
  • Each user can enable a second factor (TOTP) with an authenticator app. Once enabled, the database rejects sessions that have not passed it, even with a valid password.
  • Sign-in and password recovery are rate-limited.

API keys

  • Only owners and admins can create, view and revoke them.
  • The secret is shown once, when the key is created. Granel stores only its SHA-256 hash and a prefix to identify it.
  • Each key acts with a role (admin, trader or viewer; never owner), can have an expiry date and can be revoked at any time.
  • A key cannot read the team directory or billing data.
  • API v1 keys are read-only, with hourly request limits per organisation and per IP address, and a separate export limit.

Audit log

Recorded actions store who, what, when and the changes made. The table is insert-only: there is no way, from the application or the data API, to edit or delete an entry. Owners and admins can export it as CSV.

Today the log covers deal edits and status changes (bulk actions included), deal duplication, containers, settlement, capture confirmation, team changes and invitations, and API key management. Other actions in the application do not create an entry yet.

In transit and in the browser

  • All traffic goes over HTTPS, with HSTS.
  • Every response carries security headers: a content security policy (CSP) and a ban on embedding the site in third-party frames.
  • Documents are kept in private storage, separated by organisation, and downloaded through signed links that expire after 60 minutes.

Capture channels

  • WhatsApp messages are accepted only with Meta’s signature (X-Hub-Signature-256), and Telegram messages only with each connection’s secret token. Both checks run in constant time, and the webhooks are rate-limited.
  • The text of each message is sent to an AI provider to extract the deal, which a user reviews before the deal is created. Which providers are involved and where they process data is in the privacy policy.

Personal data and providers

  • Sub-processors and international transfers: privacy policy.
  • Retention periods by category: retention table.
  • Data processing agreement (Art. 28 GDPR): DPA, currently a draft pending legal review.
  • You can export your deals as CSV or Excel at any time, including when the organisation is read-only.

Contact

For security questions, or to report a vulnerability, use the contact form. If it involves personal data, write to privacy@granel.io.