Verified sign-in
Email verification and multi-factor authentication are enforced for authenticated users before they can access sensitive workflows.
Fundamentl protects grantmaking, award management, CSR, employee giving, documents, reporting, and administrative actions with verified access, organization isolation, auditability, and server-side controls.
Built for foundations that need to answer security questions before procurement asks.
Trust readiness
Enterprise security review
Email verified
Required before access
Role validation
Admin, reviewer, employee, applicant
Organization boundary
Workspace-scoped records
Audit trail
Security events recorded
Private files
Authorized access paths
Server APIs
Critical actions enforced
Open roadmap
SAML/OIDC SSO and SCIM lifecycle provisioning are implemented. Device inventory, broader encryption coverage, independent penetration testing, and SOC 2 assurance remain active work.
What we protect
Foundations manage more than forms. They handle organizational records, funding decisions, employee activity, receipts, reports, private attachments, and administrative approvals. The security model is built around those workflows.
Grant applications and attachments
Award requirements, reports, and documents
Employee giving and volunteer records
Receipts, matching gift requests, and approval notes
Nonprofit organization records
User identities, roles, and workspace memberships
Operational reports, exports, and board materials
Administrative settings and security policies
Current controls
Email verification and multi-factor authentication are enforced for authenticated users before they can access sensitive workflows.
Admins, reviewers, employees, nonprofit applicants, and CSR administrators are separated by role and organization membership.
Foundation and CSR data is scoped by organization so users only reach the workspace, records, documents, and actions they are authorized to use.
Critical grant, CSR, reporting, storage, and membership actions run through authenticated server APIs with verified identity context.
Uploaded documents are protected by storage rules, metadata checks, and access paths that avoid exposing private file browsing.
Security-relevant events such as logins, invites, MFA enrollment, exports, file access, policy changes, and administrative actions are recorded.
Infrastructure
Fundamentl uses Firebase, Google Cloud, and Vercel so authentication, database, document storage, hosting, and server execution inherit mature managed infrastructure.
Authentication
Firebase Authentication and Identity Platform manage passwords, Google sign-in, email verification, and MFA enrollment.
Application database
Cloud Firestore stores foundation, nonprofit, grant, award, CSR, reporting, audit, and configuration records.
Documents
Cloud Storage stores uploaded files such as receipts, agreements, reports, logos, and award requirement documents.
Server enforcement
Vercel serverless APIs validate identity tokens and centralize sensitive write actions before data is changed.
Transport
All public application traffic is served over HTTPS with security headers configured at the edge.
Monitoring and evidence
Audit logs, operational checklists, incident response runbooks, and backup evidence scripts support internal review.
Evidence and operations
The product includes security activity visibility for users and administrators. The operating system also includes internal artifacts that support procurement, risk review, and incident preparation.
Security overview and control summary
Access control matrix
Incident response runbook
Subprocessor list
Operational security checklist
Security activity and trust readiness exports from the Security Center
Enterprise roadmap
We do not want security review to depend on vague claims. These controls are explicit roadmap items for larger enterprise deployments.
Administrator session revocation for workspace members
Security alert delivery to Slack or a security operations system
Expanding field-level encryption coverage beyond organization tax IDs
Formal penetration testing, SOC 2 readiness, and a public trust center
Security review FAQ
This page is intentionally plain about what exists today and what is still on the roadmap. That makes procurement, IT, and leadership conversations faster and more credible.
Do users have to verify their identity before accessing sensitive records?
Yes. Fundamentl supports email verification and requires multi-factor authentication for authenticated users before they continue into protected workflows.
Can one organization see another organization data?
Organization membership and workspace identifiers are used across database rules, server APIs, subscriptions, storage paths, and UI routing so records remain scoped to the authorized workspace.
Are critical actions trusted only because the browser says so?
No. Critical actions are moving behind server APIs that validate the Firebase identity token, organization membership, role, and action type before updating records.
Can administrators prove what happened later?
Security audit logs record events such as sign-in activity, MFA enrollment, invitations, policy changes, file access, exports, and critical administrative actions.
Is Fundamentl SOC 2 certified today?
Not yet. SAML/OIDC SSO and SCIM lifecycle provisioning are implemented, while SOC 2 and independent penetration-testing evidence remain pending external assessment.
Workspace administrators can download a trust readiness packet from Settings, and security reviewers can contact us directly for follow-up questions.