Security & Trust

• ✓Production traffic is served over HTTPS/TLS, with HSTS instructing supported browsers to continue using HTTPS.
• ✓Database and file-storage encryption at rest are provided by the configured infrastructure providers.
• ✓Authenticated requests are authorized on the server against the active organization membership.
• ✓GrantProof-hosted uploads are private and are served through an authenticated, organization-scoped file route using non-guessable storage names.
• ✓Session cookies are HttpOnly, Secure in production, and SameSite-scoped; revoking a membership removes its active sessions.
• ✓Passwords are protected with one-way hashing and are not stored as readable plaintext.
• ✓Evidence uploads use a deny-by-default file allowlist, a 3 MB application limit, and byte-level format checks; executable, script, active web-file, and legacy binary Office formats are rejected.
• ✓Evidence can be archived reversibly, restored as Needs review, or permanently deleted with an explicit confirmation step.
• ✓Permanent evidence deletion removes the application record immediately and durably queues an unshared GrantProof-hosted file for deletion and retry; shared files remain until their final live reference is deleted, and external cloud links remain in the customer's storage.
• ✓Organization owners can permanently purge the organization, its application records, memberships, and GrantProof-hosted files after exact-name confirmation, password step-up, and fail-closed billing verification.
• ✓Security-relevant actions are recorded in the organization audit history where implemented.
• ✓The optional AI assistant treats customer-entered and document-derived content as untrusted evidence rather than instructions.
• ✓Application logging uses redaction rules for credentials, tokens, email addresses, notes, document text, and other sensitive fields.
• ✓GrantProof does not sell customer data or use customer records to train AI models.

What data do you collect?

Only what you enter or upload: grant details, budgets, transactions, evidence documents and their notes, deadlines, and your team's names and email addresses. We add no third-party analytics or tracking. We encourage you to collect the minimum — GrantProof works from amounts and document titles, not personal identifiers.

Where is my data stored?

Structured records live in a managed PostgreSQL database (Neon). Uploaded files live in private file storage (Vercel Blob). The application runs on Vercel. All are hosted in the United States.

How is it encrypted?

In transit: everything is served over HTTPS/TLS, and HSTS forces browsers to use HTTPS. At rest: our database and file-storage providers (Neon and Vercel) encrypt stored data.

Who can access my data?

Only members of your organization whom you invite, each limited by their role. Every request is authorized on the server against your organization. A small number of GrantProof operators have administrative access to production infrastructure to run and support the service.

Is my data used to train AI models?

No. We do not use your data to train AI models, and we do not opt in to model training with our AI provider. The optional Readiness Assistant is off by default.

What information is sent to AI providers?

Only when an authorized user in an organization with an active GrantProof trial or subscription explicitly runs the Readiness Assistant, and only computed readiness fields — grant names, amounts, statuses, deadlines, evidence titles and notes, and missing-evidence descriptions. We never send raw uploaded file contents, passwords, API keys, or billing data. Uploaded text is treated strictly as untrusted evidence, never as instructions to the model.

Which third parties process my data?

See the full subprocessor list. Today: Vercel (hosting/files), Neon (database), and — only if you use them — OpenAI (assistant), Stripe (billing), and Resend (email).

How long is data retained, and can I permanently delete it?

Your data is retained until you delete it. You can permanently delete any single document from the Evidence Binder, or delete your entire organization from Settings. Database access is removed immediately; stored-file deletion is attempted immediately and durably retried if the storage provider is unavailable. Encrypted infrastructure backups roll off on the providers' standard schedules.

How are tenant boundaries enforced?

Every database query and file request is scoped to your organization in server-side code, and sessions are bound to an organization membership. A request for another organization's record returns "not found." Isolation is enforced in application code on a shared database — not physically separate databases per customer.

What happens if an account is compromised?

An organization admin can revoke or remove any member; doing so deletes that member's active sessions immediately. Audit records show who did what, so you can review activity. If you suspect a compromise, contact us right away using the address below.

Can sensitive fields be excluded or redacted?

Yes. GrantProof does not require personal identifiers to work. Redact or exclude unnecessary sensitive information (for example, participant names or SSNs) before uploading — keep records at the level of amounts, dates, and document titles wherever possible.

Here is the full path your records take, end to end:

1. You sign in over HTTPS. Your session is a server-side record tied to your organization membership; the cookie is HttpOnly and Secure.
2. You enter grant data or upload a file. Files go straight to private storage under a random name; nothing is public.
3. GrantProof computes readiness (money at risk, proof score, missing evidence) from your records. This runs on our servers — no third party is involved.
4. To open a file, your browser calls an authenticated route that re-checks your session and organization on every request, then streams the file back. There is no public or guessable file URL.
5. Only if an authorized user runs the optional Readiness Assistant do scoped structured fields (including titles and notes, but never raw file bytes or full extracted text) go to our AI provider, over an encrypted connection, and only for that request.
6. When you delete a document or organization, database access is removed immediately and stored files are deleted immediately or retried through a durable cleanup queue.

Before you upload, please note:

• Allowed file types are documents, spreadsheets, and images (PDF, Word, Excel, CSV, text, PNG/JPG and similar), up to 3 MB. Programs, scripts, and web files are rejected.
• Files are stored privately and served only to your organization through an authenticated route. They are never indexed or publicly linkable.
• Please redact information you don’t need in GrantProof — participant names, Social Security numbers, and other personal identifiers — before uploading. GrantProof does not need them to assess readiness.
• Uploaded document text is treated as untrusted evidence. If a document contains text that looks like instructions to our AI, it is ignored, not obeyed.
• Do not upload Protected Health Information (PHI). We do not offer a HIPAA Business Associate Agreement.

These are the third parties that may process your data, and exactly what each receives:

Being honest about our limits is part of being trustworthy. Today:

• ✕GrantProof is not currently certified under SOC 2, HIPAA, FedRAMP, ISO 27001, PCI DSS, GDPR, or CCPA.
• ✕GrantProof does not currently offer a Business Associate Agreement. Do not upload Protected Health Information unless and until that changes in writing.
• ✕Multi-factor authentication and single sign-on are not part of this security baseline.
• ✕Tenant isolation is enforced through authenticated application and database queries on shared infrastructure rather than a separate database per customer.
• ✕The restored rate limiter is per-instance and in-memory, not a distributed rate-limit guarantee across every serverless instance.
• ✕GrantProof has not completed an independent third-party penetration test or security audit.
• ✕GrantProof has not published contractual recovery-time or recovery-point objectives.

• GrantProof is an early-stage product operated by a small team. A limited number of operators may require administrative infrastructure access to operate and support the service.
• Permanent deletion removes data from the active GrantProof application and GrantProof-hosted file storage. Infrastructure-provider backup copies, if any, expire under provider-controlled backup schedules and are not represented as individually customer-restorable.
• Disaster-recovery and backup procedures are being formalized; the Trust Center does not promise an unverified backup frequency, restore test cadence, recovery time, or recovery point.
• Hosting and listed subprocessors are currently described as United States-based for this pilot-stage deployment.
• Customers should upload only the minimum information needed and redact unnecessary participant identifiers or other sensitive fields before upload.

To ask a security question or report a vulnerability, email erica@grantreadysystems.com. We aim to acknowledge reports within two business days. Please do not include live customer data in your report.