SECURITY
Security & hosting
How MuniGrowth protects your municipality's data — and where it lives.
Where your data is hosted
MuniGrowth production runs on VPS infrastructure in Frankfurt, Germany (EU region), subject to change with notice. Municipal data — LED plans, projects, stakeholder records, and exports — is stored in a dedicated PostgreSQL database on that environment, behind HTTPS and tenant-scoped application logic.
Each municipality is a separate tenant. Users only see data for tenants they belong to; cross-tenant access is blocked in middleware, permissions, and query scoping.
- Primary production hosting: Frankfurt, Germany (EU region)
- Encrypted transport (HTTPS/TLS) for all browser and API traffic
- Database backups on a scheduled basis
- Operational monitoring and error alerting (Sentry)
EU or cross-border clients: see our Privacy Policy and Data Processing Agreement for transfer mechanisms. Confirm with your legal team before procurement.
Core security controls
- Tenant-aware data isolation across all core modules
- Role-based access controls and tenant-scoped permissions
- Secure session defaults and CSRF protection on browser forms
- Rate limiting and abuse mitigation on public endpoints
- Security headers including CSP, Referrer-Policy, and Permissions-Policy
- Operational logging for auditability and incident response
AI and third-party services
When you use AI drafting features, prompts are sent to configured cloud LLM providers (for example OpenRouter) to generate suggestions. You review and approve content before it becomes official municipal record. See our AI Policy.
We do not sell municipality data. Analytics (if enabled) uses privacy-conscious Google Analytics settings with cookie consent on the public site.
Application security
The platform enforces authenticated API access by default, validates tenant membership in middleware and permission layers, and applies anti-CSRF controls for browser sessions.
Vulnerability management
We continuously improve code quality, tighten dependency hygiene, and apply secure coding patterns across data access, input handling, and integrations.
Status and incidents
Current platform health is published at munigrowth.com/status/. For security questions or to report a concern, contact security@munigrowth.com.