NaliGrid Security Infrastructure

Every data row in our application database is protected by strict row-level access control policies:

• Planners can only read and write data belonging to their registered organization.
• Coordinators can only read events and tasks they are explicitly invited or assigned to.
• Client portals are secured using secure cryptographic tokens, preventing enumeration attacks.

To prevent unauthorized manipulation of budget records and event states, we enforce database-level access rules. Direct client-side requests attempting to modify payment statuses are blocked by database constraints. All payments must be verified secure server-to-server via API callbacks using private signing keys.

All integration keys are handled with industry-standard protection models. Private API keys for integrated services (such as Resend, Paystack, and Korapay) are never exposed to the client browser or client-side application logs. Secrets are stored encrypted in a secure vault and are only injected at runtime into isolated server environments.