Security

Our Commitment to Security

Grant Frog is committed to protecting the confidentiality, integrity, and availability of your data. We align our practices with established security frameworks, applying secure access controls, data encryption, continuous monitoring, and rigorous vendor management tailored to the scale of our organization. Security is built into how we design, operate, and maintain the platform.

This document summarizes the key security practices, infrastructure, and policies that protect your organization's grant data.

Encryption

All data transmitted to and from Grant Frog and its sub-processors is encrypted in transit using HTTPS and TLS 1.2 or higher. All data stored across our infrastructure is encrypted at rest using AES-256.

Data Centers & Infrastructure

Your data is hosted across enterprise-grade cloud providers with data centers located in the United States (Virginia). These facilities are SOC 1, SOC 2, and ISO 27001 certified, providing independent verification of the physical and operational security controls that govern where your data lives.

The majority of Grant Frog's infrastructure runs on Amazon Web Services (AWS) — the world's largest and most widely adopted cloud platform, trusted by enterprises, government agencies, and financial institutions globally.

Data is transmitted securely between these platforms using APIs that employ HTTPS encryption. PlanetScale, our relational database provider, runs on AWS. Fly.io handles application hosting with built-in redundancy.

Backups & Redundancy

Grant Frog takes a multi-layered approach to data backup and availability. Production data is continuously backed up to a separate, isolated location. Grant Frog also exports daily encrypted backups, with a 30-day rolling retention window. Redundancy is built into the infrastructure at multiple levels. All backups are encrypted.

Access Control

Access to your data is restricted to approved Grant Frog team members who require it to perform their duties, following the principle of least privilege. All accounts are protected with two-factor authentication (2FA). Shared root or administrative accounts are not used; every individual operates under their own account with role-appropriate permissions. Customer access to the application is protected via SSL/TLS. Your organization's data is logically separated from other customers and access-controlled at the account level.

Billing & Payment Security

Billing for paid Grant Frog accounts is processed entirely through Stripe — the payment infrastructure trusted by millions of businesses worldwide, and one of the most rigorously security-audited platforms in the industry. Stripe is PCI DSS Level 1 certified, the highest level of compliance in the payment card industry. Grant Frog does not store credit card numbers, CVV codes, or other sensitive payment details on our own servers. All payment data is handled and encrypted directly by Stripe in accordance with Payment Card Industry Data Security Standard requirements. We retain your billing address for invoicing and fraud detection purposes.

Monitoring & Incident Response

Our systems are monitored around the clock with automated alerting for performance, capacity, and security threats. Software dependencies are continuously scanned for vulnerabilities using automated tools, with patches applied promptly. The current status of Grant Frog's systems is available at status.grantfrog.com.

We maintain a formal Incident Response Plan with defined roles, responsibilities, and procedures. If a security incident affects your data, we will notify your designated contact within 72 hours, share a full account of what occurred, and coordinate remediation.

Third-Party Sub-Processors

We evaluate and track all critical third-party vendors. Each sub-processor publishes a Data Processing Addendum (DPA) and maintains industry-standard security controls.

Privacy

For our full privacy policy, see details at grantfrog.com/privacy.

DPA

For custom security needs, please reach out to us at grantfrog.com/contact

Security Contact

For questions about our security practices or to report a concern, please reach out directly at grantfrog.com/contact.