Access is restricted to accounts you approve, the data is encrypted so no one else can read it, and each pantry's records are isolated.
Overview
PantryInsight stores personal information about the families you serve, including names, addresses, and household composition. The safeguards below apply to all of it.
Your data is hosted on Google Cloud and TiDB Cloud, both independently certified to ISO 27001 and SOC 2.
Data is encrypted while moving over the network and while stored, so it can't be read in between.
Passwords are stored as one-way hashes, not the original value. We cannot read them either.
Every page requires a login, and new accounts must be approved by an admin before they work.
Your data is used only for your dashboard. You own it and can export or delete it at any time.
Each pantry's records are stored in a separate database, never mixed with another organization's.
The built-in assistant can read data to answer questions but cannot modify it, and it never receives individual records.
How it works
Each topic below opens with a summary. The toggle beneath it contains the technical detail required for IT review or grant reporting.
Your data is hosted on two independently audited cloud platforms. Google Cloud runs the application and TiDB Cloud stores the database. They provide the physical security, backups, and uptime, certified to standards including ISO 27001 and SOC 2.
Scope: these certifications apply to our infrastructure providers. PantryInsight is not separately certified under ISO, PCI, or FISMA. We do not process or store payment card data, so PCI requirements do not apply.
Encryption converts data into an unreadable form that only authorized systems can decode. We apply it in two places: while data moves over the network, and while it is stored in the database. Passwords are stored only as one-way hashes, never in their original form, so they cannot be recovered, including by us.
Access is not automatic. No record is visible without logging in. New accounts must be approved by an admin before they work, and admin tools are restricted so a standard user cannot reach them, even by entering the URL directly.
401). Only a minimal allow-list of public routes (login, sign-up, reset, OAuth callback) is reachable without one.HttpOnly, Secure, SameSite, and has a bounded lifetime.X-CSRF-Token, or it's rejected with 403.429 until you wait.PantryInsight includes an assistant you can query in plain language. It can only read your data; it cannot change or delete anything. It never receives individual records. It uses the structure of your data to answer a question, and names and addresses are never sent to it.
It can only read:
SELECT only).EXPLAIN pre-check, a hard row cap, and a timeout, so nothing can exhaust the database or dump unbounded data.What it sees:
Each pantry's data is stored in its own database. There is no shared table where one organization's records sit alongside another's. This removes the most common cause of cross-tenant data leaks and makes data residency straightforward: a region's data stays in that region.
The product is multi-tenant by separation: each tenant has its own database (and, initially, its own deployment), driven by per-tenant configuration. There is no shared table requiring a tenant_id filter, which eliminates the most common multi-tenant leak and makes data residency (e.g. keeping an EU pantry's data in the EU) straightforward.
Your data is backed up automatically and stored redundantly, so a single server failure won't lose it. We maintain logs and alerts so issues are detected quickly. You own your data and can export it in full at any time.
Last updated: June 22, 2026.
Contact us for board evaluation, grant reporting, or to report a vulnerability.