Your data, described exactly as we handle it.
Boards, executive directors, and compliance officers ask the same questions before they let grant narratives near an AI tool. These are the answers, and every one of them mirrors a control that exists in the product today.
Your data belongs to your organization
Every record (workspaces, narratives, attachments, knowledge documents, budgets, conversations) is stored under your organization's identity and every request is checked against it. Another organization's users cannot reach your data. Inside your organization, Admin, Editor, and Viewer roles apply, and Studio conversations are private to the person who created them.
No training on your data
TGS runs its AI through Amazon Bedrock, where the terms contractually prohibit using customer data to train models. Your narratives, uploads, and conversations are processed to answer your requests and nothing else.
Where your data lives
All processing stays in a single AWS region in the United States. Web search is the one feature that reaches beyond the platform and it works the way searching in your browser does: your search terms go to a search provider, and nothing else about your work goes with them. It is off until you turn it on.
Encryption
Data is encrypted in transit (TLS) and at rest (AWS-managed keys across our databases and document storage). File downloads use short-lived signed links rather than public URLs, and the API accepts traffic only through our verified front door.
Sign-in and access
Sign-in runs on AWS Cognito with short-lived session tokens. Organizations can require two-factor authentication for every member. TGS support staff can assist with your account only through an audited access mechanism restricted to authorized administrators, and every use is logged.
AI safeguards
Before anything you type is sent to AI, TGS scans it and warns you if it looks like it contains personal or health information. On the way out, layered anti-fabrication guardrails check answers against your real documents: a statistic without a source is visibly flagged instead of stated as fact.
Audit trail
Sign-ins and failed attempts, downloads, deletions, support access, and AI usage leave an audit trail scoped to your organization. AI usage records capture which feature ran, token counts, and cost; the content of your work is not part of those records.
Compliance, stated exactly as it is
Our SOC 2 program is underway: policies, controls, and independent audit. The report will be available to customers under NDA when complete. TGS is a grant management platform, not a clinical or medical system: it is not HIPAA compliant, no plan includes a Business Associate Agreement, and protected health information should never be entered. Because our customers work in behavioral health, the product warns before text that looks like PHI reaches the AI. If a certification is not finished, we will not imply that it is.
Security questionnaires and DPAs
Enterprise customers get a security review and a data processing agreement as part of the plan. If your procurement process needs a questionnaire completed, a subprocessor list, or a conversation with the technical entrepreneur who built the platform, email support@truegrantsolutions.com and we will schedule it.
Reporting a vulnerability
If you believe you have found a security issue in TGS, email support@truegrantsolutions.com with "Security report" in the subject. We will acknowledge within two business days and keep you informed until it is resolved.