Security & Privacy
Grant applications contain your organization's most sensitive strategic and financial data. Here is exactly how we handle it.
Last updated: September 14, 2026 · Reviewed by qualified legal counsel September 2026 · Breach notification covers all 50 states + DC + territories
Our commitments to you
- No selling or renting your data to third parties — ever
- No using your content to train AI models without explicit opt-in consent
- No cross-site tracking or third-party advertising cookies
- No spam — only transactional and product emails (opt-out available anytime)
- No data transfers outside the US except as required for legacy EEA/UK users (governed by Standard Contractual Clauses)
- Full account deletion available at any time (data removed within 30 days)
- Breach notification within 72 hours of discovery where feasible
- IP addresses automatically purged after 90 days
- Automated PII purge routines run on a scheduled basis
- All personnel access to user data is logged and subject to RBAC
Your data belongs to you — period
Grant Search US (doing business as "Grant Search International™") is the legal entity that operates this Platform. References to "Grant Search US" or "Grant Search International™" throughout this page refer to the same legal entity. Every piece of information you share with Grant Search US — your profile, uploaded documents, AI-generated drafts — is used solely to provide the service to you. It is never sold to third parties, never shared for advertising purposes, and never used to train AI models without your explicit opt-in consent.
AI processing, not AI training
We use enterprise-tier AI APIs to generate your grant narratives and analysis. Under the Data Processing Agreements governing those APIs, your inputs are explicitly prohibited from being used for model training or improvement. Your application content is processed transiently to generate your output and is not retained by AI providers beyond the processing window.
Encryption in transit and at rest
All data is encrypted during transmission using TLS 1.3 and stored at rest using AES-256 encryption. Your application content, organization profile, Tax ID/EIN, and credentials are protected at every stage of storage and transmission. Password hashing uses bcrypt with a minimum work factor of 12.
Access controls & authentication
Access to user data within Grant Search US systems is governed by role-based access controls (RBAC). Only personnel with a legitimate operational need can access user data, and all access is logged. We support secure session management with automatic token expiration, CSRF protection, and brute-force rate limiting on authentication endpoints.
US-based data storage
All user data is stored on servers located within the United States (hosted by Base44 infrastructure). For EEA/UK legacy accounts, cross-border transfers are governed by Standard Contractual Clauses (SCCs) as described in our Privacy Policy. We do not replicate your personal data to international data centers for purposes other than service delivery.
Breach notification — 72-hour commitment (All 50 States)
In the event of a security incident involving your personal data, we are committed to notifying affected users within 72 hours of discovery where feasible, in compliance with applicable state breach notification laws. All 50 states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands have enacted security breach notification laws requiring notification to affected individuals and/or state authorities (e.g., California Civ. Code § 1798.82, New York Gen. Bus. Law § 899-aa, Texas Bus. & Com. Code § 521.053, Florida Stat. § 501.171, and equivalent statutes in all other states). We will notify applicable state authorities within the timeframes required by each applicable state law (typically 30–90 days depending on the jurisdiction). For EEA/UK legacy accounts, we also comply with GDPR Article 33 (72-hour supervisory authority notification) and UK GDPR/Privacy and Electronic Communications Regulations.
Delete everything, any time
You have full control. You can permanently delete your account and all associated data at any time from your profile settings. Personal data is removed within 30 days of a deletion request (financial transaction records may be retained up to 7 years as required by law for tax and accounting purposes). Deletion cannot be reversed.
No secondary use of your content
Your uploaded documents, grant answers, and narrative drafts are used only to serve your account. They are never aggregated for research without your opt-in consent, never shared with other users, and never used beyond what is strictly necessary to deliver the product. Automated PII purge routines remove IP addresses after 90 days.
FERPA-compatible practices
Grant Search US is aware of FERPA obligations for educational institutions. Our platform does not store student education records, and our data handling is designed to be compatible with institutional FERPA policies. Do not upload student education records — see our Terms & Conditions Section 8b for full FERPA guidance.
Tribal and Indigenous data sovereignty
We recognize that tribal nations, tribal colleges, and Indigenous-serving organizations operate under data sovereignty frameworks (including OCAP® Principles — Ownership, Control, Access, and Possession). You retain full ownership of all uploaded content. No data is shared with third parties beyond AI processing, and full deletion is always available.
| Control | Implementation |
|---|---|
| Encryption (in transit) | TLS 1.3 |
| Encryption (at rest) | AES-256 |
| Password hashing | Bcrypt (work factor ≥12) |
| Session management | Short-lived signed tokens; auto-expiry on logout |
| CSRF protection | CSRF tokens on all state-changing requests |
| Rate limiting | Authentication endpoints rate-limited; bot protection active |
| Data residency | United States (Base44 infrastructure) |
| AI data processing | Enterprise DPAs; no model training on user data |
| PII auto-purge | IP addresses purged after 90 days; automated scheduler |
| Access controls | Role-based access control (RBAC); personnel access logged |
| Breach notification | 72-hour user notification; state authority notification per applicable law |
| Vulnerability management | Regular security reviews; responsible disclosure accepted |
If you discover a security vulnerability in the Grant Search US platform, we encourage responsible disclosure. Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate it.
Report security vulnerabilities to: security@grantsearchus.com or via our Support page with subject "Security Vulnerability Report."
What to include: Description of the vulnerability, steps to reproduce, potential impact, and your contact information.
Response commitment: We will acknowledge receipt within 2 business days and provide an estimated timeline for remediation.
Safe harbor: We will not pursue legal action against researchers who report vulnerabilities in good faith following this process, provided they do not exploit the vulnerability beyond what is necessary to demonstrate the issue.
Grant Search US maintains active insurance coverage and a formalized corporate structure to protect the company and its users:
Cyber Liability Insurance
Active July 11, 2026 — covers data breach response, forensic investigation, notification costs, and third-party liability arising from security incidents.
E&O / Professional Liability
Active July 11, 2026 — Errors & Omissions coverage for claims arising from AI-generated content, drafting errors, and professional service delivery.
Corporate Veil
Grant Search US, Inc. incorporated as an S corporation on July 7, 2026 — provides limited liability protection separating personal and business assets.
Contractual Protections
Terms of Service v11 (July 12, 2026) includes binding arbitration, $100 liability cap, shortened limitations period, indemnification, and force majeure clauses.
Insurance policies are reviewed annually and maintained for the duration of platform operations. Certificate of Insurance available to enterprise customers and resellers upon request via legal@grantsearchus.com.
Grant Search US designs its security practices to be consistent with the following frameworks and regulatory requirements:
Note: "Compatible with" and "designed to comply with" does not constitute a formal certification unless explicitly stated. SOC 2 Type II coverage is inherited via our infrastructure provider (Base44). Grant Search US does not hold an independent SOC 2 Type II certification.
Security Questions & Contact
For security questions, vulnerability reports, or data incident inquiries: security@grantsearchus.com
For privacy rights requests: privacy@grantsearchus.com
For general support: Support page