SECURITY
Security & hosting
How MuniGrowth protects your municipality's data — and where it lives.
Where your data is hosted
Production hosting regions and infrastructure providers are documented in your executed order form or DPA. Municipal data — LED plans, projects, stakeholder records, and exports — is stored in a PostgreSQL database in the contracted environment, protected by HTTPS and tenant-scoped application controls.
Each municipality is a separate tenant. Users only see data for tenants they belong to; cross-tenant access is blocked in middleware, permissions, and query scoping.
- Production hosting: as documented in your executed DPA or order form
- Encrypted transport (HTTPS/TLS) for all browser and API traffic
- Database backups on a scheduled basis where configured
- Operational monitoring and error alerting (Sentry, when configured)
EU or cross-border clients: see our Privacy Policy and Data Processing Agreement for transfer mechanisms. Confirm with your legal team before procurement.
Core security controls
- Tenant-aware data isolation across all core modules
- Role-based access controls and tenant-scoped permissions
- Secure session defaults and CSRF protection on browser forms
- Rate limiting and abuse mitigation on public endpoints
- Security headers including CSP, Referrer-Policy, and Permissions-Policy
- Operational logging for auditability and incident response
AI and third-party services
When you use AI drafting features, prompts are sent to configured cloud LLM providers (for example OpenRouter) to generate suggestions. You review and approve content before it becomes official municipal record. See our AI Policy.
We do not sell municipality data. Analytics (if enabled) uses privacy-conscious Google Analytics settings with cookie consent on the public site.
Application security
The platform enforces authenticated API access by default, validates tenant membership in middleware and permission layers, and applies anti-CSRF controls for browser sessions.
Vulnerability management
We continuously improve code quality, tighten dependency hygiene, and apply secure coding patterns across data access, input handling, and integrations.
Status and incidents
Current platform health is published at munigrowth.com/status/. For security questions or to report a concern, contact contact@munigrowth.com.