Data handling

What is retained. The raw CSV or XLSX is stored in a private storage bucket named grant-compliance. The object path starts with the organization id, then files, the file hash, and the file name. The application does not return those bytes from a page. The sealed replay is stored in the deployment database tables mdr_runs, mdr_deals, mdr_records, mdr_thresholds, and mdr_approvers. Reviewer dispositions are additional mdr_records. This profile does not write mdr_approvals.

Masking and fingerprints. On ingest, account numbers, vendor or payee, entered-by, and approved-by are replaced with a masked display and an HMAC-SHA256 fingerprint. The key is the environment variable GRANT_COMPLIANCE_FINGERPRINT_KEY. The message is the organization id, a newline, and the normalized value, so the same identifier in two organizations does not match. Delegation names stored on mdr_approvers and in the rule-pack snapshot are the masked display and fingerprint. Transaction ids, dates, amounts, award codes, and citations are retained. Digit runs of five or more in free text are reduced to a last four. Finding text names the rule and the missing field. It does not copy the vendor name.

How long. This profile does not run an automatic retention job on the raw files or on sealed records. A raw file stays until an authenticated member of the owning organization deletes it. Sealed records are append-only. The reseed path deletes sealed records only for an organization marked as a public demo.

Deletion on request. An authenticated member of the owning organization can delete one raw upload by file hash and file name. That delete does not remove the sealed record. Deletion of sealed records for an organization that is not a public demo is refused.

NDA. A mutual nondisclosure agreement is available on request. This application does not generate or store one.

The public report on this site is a fictitious sample. Real grantee exports are not processed in that sample.