Security & Data Protection
This page describes only controls that are implemented in GrantGuard today.
Tenant isolation
Every record is scoped to an organization. Database row-level security policies check organization membership on every read and write, so a record from one organization cannot be returned to another — including through direct API or URL manipulation.
Role-based access
Organization administrators, grant managers, procurement managers, finance, program managers, approvers and read-only reviewers each see and do only what their role permits.
Private document storage
Award documents, policies, quotes, invoices and evidence are stored in a private bucket. Files are served through short-lived signed links to authorized organization users only.
Buyer / vendor separation
Vendors can only see the solicitations they were invited to and their own responses. Internal vendor notes, evaluations and scoring are never exposed to vendors.
Sealed solicitations
When an RFQ is configured as sealed, response pricing stays hidden until the deadline passes.
Review Room scoping
External reviewers see only the grants, procurements and records explicitly shared with them, for a defined access window, with read-only access and an access history.
AI context isolation
AI analysis runs server-side and is given only the requesting organization's own awards, policies, rules, purchases and documents.
Authentication
Email/password and Google sign-in with managed session handling. Passwords are never stored by GrantGuard. Payment card data is never stored by GrantGuard.
Audit history
Procurement activity, human determinations, overrides, exceptions and access events are recorded and preserved rather than overwritten.
What we do not claim
GrantGuard has not obtained FedRAMP authorization, SOC 2 attestation, ISO 27001 certification, HIPAA compliance validation, or any government certification, and we do not represent otherwise. If your organization requires a formal attestation before procurement, contact us and we will tell you exactly where we are.
Data portability
Organization administrators can export grants, budgets, purchases, vendors, contracts, findings, document manifests and activity records to CSV at any time from the Import & Export center.