Customer-readable privacy operations

Know where data goes and how its lifecycle is controlled.

GrantPilot remains synthetic-data-only. No subprocessor is currently authorized to receive real customer grant content through this deployment; production residency, processor terms, and restoration evidence remain acceptance gates.

Review current availability ↗View product tour

Subprocessors

Current authorized real-customer-data list: none. Candidate categories—hosting/database, object storage and KMS, transactional email, malware scanning, monitoring, OCR, and optional AI—remain disabled for real data until the provider, location, purpose, contract, security review, and deletion terms are published and accepted.

Residency and transfers

The controlled U.S. market scope is not a data-residency promise. Production hosting region, backup region, support access location, and any cross-border transfer mechanism must be stated in the customer agreement before real data is enabled.

Retention and legal hold

Organization administrators choose an approved retention period. Expired records enter a controlled lifecycle; verified legal holds stop deletion. Audit, security, financial, and submission records may have distinct documented obligations and are not silently removed.

Export and closure

Users can download portable personal-account metadata and close eligible accounts through a password-confirmed self-service workflow. Organization-owned records remain with the organization; complete organization export is still under implementation. Ownership transfer, session revocation, privacy requests, and documented offboarding are available controls.

Deletion and recovery

Deletion is authorized, logged, bounded by retention and legal hold, and reconciled with object storage. Backup expiry is separate from active deletion. Production database-plus-object restoration must pass before real customer data is accepted.

Secure sharing

Document shares are bound to the intended recipient, require a separately delivered access code, expire, enforce download limits, support revocation, and record access outcomes. A share does not make the underlying evidence public.

Privacy noticeLearn more →Security controlsLearn more →Live platform statusLearn more →

Evaluate the controlled workflow.

Review current limitations and release gates before using real customer data.

Review current availability View product tour