Security and responsible disclosure

• All traffic is TLS; data is encrypted at rest by our infrastructure vendors.
• Sign-in runs on Supabase Auth: OAuth (Google, Microsoft, Apple), one-time email and SMS codes, and per-organization SAML single sign-on for enterprises.
• Organization roles gate every admin surface; staff (HQ) access is separately gated and audit-logged.
• Partner API keys are stored as SHA-256 hashes and shown once at creation; webhooks are HMAC-SHA256 signed with per-organization secrets, and every delivery carries a timestamp inside the signature, so the receiving system can reject a stale or replayed one.
• Admin actions land in an audit log the organization can review.

If you believe you’ve found a security issue, email security@corporategivinghub.com with steps to reproduce. Please don’t access data that isn’t yours, and give us a reasonable window to fix before public disclosure. We aim to reply within 3 business days. There is no bug bounty. If you would like credit for a report we act on, say so and we’ll agree with you how to give it.

corporategivinghub.com, api.corporategivinghub.com, and the partner API surface.

auth.corporategivinghub.com is in scope for its configuration only. It is our own domain name pointed at the Supabase project that runs sign-in, so what we set on that project is ours to fix and we want those reports: which identity providers are enabled, the redirect allowlist, the token and session settings, the SAML metadata, and whether self-service sign-up is open. The Supabase platform answering on that name is not ours to patch, so a flaw in the service itself goes to Supabase.

Out of scope: volumetric denial of service, social engineering of our users, and third-party services we integrate with (report those to the vendor).