BackTribal Data Sovereignty

Data Sovereignty Policy

GrantsPath is built with tribal data sovereignty as a core principle. This page documents exactly what data we collect, where it is stored, which services process it, and your rights as a sovereign nation.

Last updated: March 6, 2026

CARE Principles Alignment

GrantsPath aligns with the CARE Principles for Indigenous Data Governance, developed by the Global Indigenous Data Alliance:

Collective Benefit

Data ecosystems should enable Indigenous peoples to derive benefit from the data.

Authority to Control

Indigenous peoples have rights to control and govern their data.

Responsibility

Those working with Indigenous data have a responsibility to nurture respectful relationships.

Ethics

Indigenous peoples' rights and wellbeing should be the primary concern at all stages of the data life cycle.

Our Commitments

Your data belongs to your nation

All data entered into GrantsPath is owned by your tribal nation. We are custodians, not owners. You can export or delete your data at any time with no restrictions.

No training on tribal data

Our AI providers (Anthropic, and Google for grant matching) do not use our inputs for model training. Your grant strategies, tribal context, and sovereign intelligence are never used to train AI models.

No selling or sharing

We never sell, rent or share your data with third parties. The service providers listed on this page run parts of GrantsPath and receive only what their part needs; none of them trains AI on it.

US data residency

All data is stored and processed within the United States. Database, file storage, authentication, and AI processing all occur in US-based infrastructure.

Right to deletion

You can permanently delete all your data at any time through Settings. Deletion is irreversible and removes data across all systems, including backups within 30 days.

Audit-ready compliance

GrantsPath maintains activity logs, boundary certificates, and defense packages to support federal audit compliance under 2 CFR 200.334 record retention requirements.

Third-Party Data Flow

The following table shows every external service that processes tribal data, what data they receive, and their data handling practices.

Service	Provider	Region	Data Shared	Used for Training
Hosting	Vercel	US-East (Washington, D.C.)	Everything the application handles, in transit; page-view counts and page-speed timings without cookies	No
PostgreSQL Database	Neon	US-East	All records: profiles, grants, awards, applications, document text, team and settings	No
File Storage	Google Cloud Storage	US	Uploaded documents, data exports, imported source files, and encrypted nightly database backups	No
AI Reading and Drafting	Anthropic (Claude)	US	Document text, scanned pages, grant text and profile context for AI features	No
Grant Matching	Google Vertex AI	US (Iowa)	A profile summary (organization type, tribal affiliations, states, focus areas) turned into a matching fingerprint	No
Sign-in	Clerk	US	Names, email addresses, sign-in events, sessions	No
Email	SendGrid	US	Email addresses and notification content	No
Billing	Stripe	US	Billing contact and payment details; GrantsPath never sees card numbers	No
Rate Limiting	Upstash (Redis)	US	Request counters and short-lived cached lookups; no documents	No
Maps	Mapbox	US	Map tile requests and place searches from your browser (IP address, area viewed)	No
Error Alerts	Slack	US	Error messages, the page they happened on and the signed-in username, sent to the GrantsPath team	No
Text Messages	Twilio	US	Your phone number and reminder text, only if you turn on text messages	No
Nonprofit Status Check	ProPublica Nonprofit Explorer	US	Your EIN, when you ask to verify 501(c)(3) status against public IRS records	No
Boundary Check	U.S. Census Bureau (TIGERweb)	US	A project site's map coordinates, checked against tribal land boundaries	No
Import From Your Drive	Google Drive, Microsoft OneDrive / SharePoint	US	Only the files you pick, and only when you connect your drive	No

Your Data Rights

Export your data

Download your profile, applications, searches, bookmarks and activity log. Boundary certificates and defense packages download from their own pages. Available under Settings > Activity & Records.

Delete your data

Delete your own data and any personal workspace you started, permanently, under Settings > Activity & Records. To close an organization's shared workspace or your account, contact support and we'll do it with you.

Audit trail access

View a complete log of all actions taken on your account. Activity events are timestamped and include metadata for compliance reporting.

Successor handoff

Designate a successor contact to ensure institutional continuity. Grant records can be securely transferred to authorized personnel within your nation.

Self-Hosted Deployment

For tribal nations that require complete data sovereignty, GrantsPath can be deployed on your own infrastructure. Your records and files stay on your network.

Your infrastructure, your rules

Run GrantsPath on your own servers (bare metal) or a private cloud (AWS, Azure, GCP). Air-gapped networks can be arranged case by case.

Data stays on your servers

Your database and files run on your infrastructure. Sign-in and AI features use outside services today; we scope with you which features run, and where, for each deployment.

Platform engineering support

Our team works directly with your IT staff to stand up and maintain your GrantsPath environment. We handle deployment, configuration, updates, and training.

Full CARE Principles compliance

Self-hosting is the strongest expression of Authority to Control. Your nation governs every aspect of the data lifecycle with no external dependencies.

Interested in self-hosted GrantsPath?

Contact us at support@grantspath.com to discuss deployment options for your nation. We provide platform engineering services to help your team stand up a local GrantsPath environment tailored to your infrastructure and governance requirements.

Questions or Concerns

If your tribal nation has specific data governance requirements or needs a formal data processing agreement, contact us at support@grantspath.com.

We work with tribal data governance boards to ensure our practices meet your nation's standards.

This policy is reviewed quarterly and updated as our practices evolve. See also our Privacy Policy and Terms of Service.