Security by design
Multi-layered protection for your business data and your customers’ data.
Last updated: April 21, 2026
99.9%
Uptime
AES-256
Encryption
24/7
Monitoring
72h
Incident response
Security is not a feature — it is the foundation
GROW was built on principles of defense in depth and zero trust. Every layer of the platform is designed, tested, and audited to protect your data against unauthorized access, leaks, and downtime.
End-to-end encryption
Your data is encrypted in transit and at rest.
- TLS 1.3 on all connections (HTTPS enforced, HSTS enabled)
- AES-256 for data at rest in the database
- Passwords stored with bcrypt + salt (never in plain text)
- Rotating access tokens with short expiration
- Secrets management via a dedicated vault (Vercel + Supabase Vault)
Robust authentication
Multiple layers to confirm that whoever signs in is who they claim to be.
- Two-factor authentication (2FA/TOTP) available on all plans
- OAuth 2.0 with Google for secure login
- Strong password policies: minimum 8 characters, real-time validation
- Rate limiting against brute-force attacks
- Sessions automatically invalidated after prolonged inactivity
Best-in-class infrastructure
Hosting on providers with the highest global certifications.
- Vercel (edge) + Supabase (Postgres) servers across multiple regions
- SOC 2 Type II, ISO 27001, and PCI-DSS Level 1 certifications
- Automatic daily backups with 30-day retention
- Multi-region replication for high availability
- Built-in DDoS protection and WAF (Web Application Firewall)
Granular access control
Principle of least privilege applied at every layer.
- Row Level Security (RLS) in the database: each business only sees its own data
- Access profiles (admin, staff) with granular permissions
- Isolated multi-tenancy by design — no leakage between accounts
- Audit logs for critical actions (login, financial edits, etc.)
- Internal team access is restricted and fully audit-trailed
Monitoring and incident response
Real-time detection and a clear process when something happens.
- SIEM with 24/7 alerts for anomalies and suspicious attempts
- Automatic health checks every 60 seconds
- On-call SRE with a response SLA of up to 15 minutes
- Communication of relevant incidents within 72h (as per LGPD)
- Public postmortems for full transparency
Regulatory compliance
Aligned with the main regulations applicable in Brazil.
- LGPD (Law 13.709/2018) — personal data processing
- Brazilian Internet Framework (Law 12.965/2014) — log retention
- PCI-DSS — card transactions via certified gateways
- Consumer Protection Code — contractual transparency
- Annual independent audits by a specialized firm
Business continuity
Plans to keep your operation running even in extreme scenarios.
- Automated daily backups (24h RPO, 4h RTO)
- Disaster recovery plan (DRP) tested every six months
- Automatic failover to a secondary region in case of failure
- Version history for critical data (finances, appointments)
- Full export of your data at any time
Your part matters too
5 recommended practices to protect your account even further
Found a vulnerability?
We appreciate responsible security researchers. We maintain a disclosure program with rewards for valid reports.
• Report to: security@grow.app
• Do not disclose publicly until the fix has been released
• We respond within 48 hours with the status of your report
• Public Hall of Fame for contributing researchers
Questions about security?
Our SRE team answers technical questions about the platform.
Talk to the security team