Security & Compliance You Can Verify
We hold ourselves to the highest security standards. Explore our compliance framework alignment, download security documentation, and review our security practices.
Security & Compliance Program
Our security practices are designed to align with industry frameworks and backed by automated evidence collection from integrated systems.
Framework Alignment
Our controls are designed to align with SOC 2, ISO 27001, HIPAA, and GDPR. SOC 2 coverage is inherited via our infrastructure provider (Base44) — not independently certified by Grant Search US.
Automated Evidence
Evidence pulled directly from AWS Config, GitHub Audit Log, Okta, and Datadog — machine-collected, not manually entered.
Chain of Custody
Every evidence artifact is traceable to its source system, collection timestamp, and verifier — full audit trail.
Continuous Monitoring
Real-time control drift detection with automated alerts — not point-in-time snapshots. Issues are caught and remediated continuously.
Compliance Frameworks We Align With
Our practices are designed to meet these industry standards
Security Reports & Documents
Download our compliance documentation. Some reports require an NDA.
Subprocessor List
Current list of all subprocessors with access to customer data, including purpose and location.
Incident Response Plan Summary
Overview of incident response procedures, severity classifications, and customer communication protocols.
Data Processing Agreement (DPA)
Standard GDPR-compliant Data Processing Agreement template for enterprise customers.
Security Whitepaper
Comprehensive overview of Grant Search US security architecture, encryption, access controls, and compliance program.
Penetration Test Report (2026)
Annual network and application penetration test by Bishop Fox. All critical and high findings remediated.
Security Practices
How we protect your data
Encryption at Rest
AES-256 encryption for all stored data including databases, backups, and file storage.
Encryption in Transit
TLS 1.2+ for all network traffic. HSTS enabled. Perfect forward secrecy.
Access Controls
Role-based access control (RBAC) with least-privilege. SSO + MFA enforced for all internal users.
Vulnerability Management
Continuous vulnerability scanning. 30-day SLA for critical patch remediation.
Incident Response
24/7 monitoring with < 4 hour critical incident response time. Documented IR playbook.
Data Retention
Configurable retention policies. Secure deletion on request per GDPR/CCPA.
Subprocessor List
Third-party services with access to customer data
| Provider | Purpose |
|---|---|
| Amazon Web Services | Cloud infrastructure hosting |
| Google Cloud Platform | AI/ML model inference |
| Stripe | Payment processing |
| Twilio / SendGrid | Email and SMS delivery |
| Okta | Identity and access management |
| Datadog | Infrastructure monitoring and logging |
Have Security Questions?
Our support team is available to answer questions about our compliance program, security practices, or to provide additional documentation under NDA.
Trust Center last updated: September 2026
Our security practices are designed to align with industry compliance frameworks.