Intro
Last updated: January 2026
Grantora provides a secure, GDPR-compliant platform designed for NGOs and civil society organizations handling sensitive program information.
We implement industry-standard technical and organizational measures to protect the confidentiality, integrity, and availability of customer data, and we maintain security controls aligned with EU regulations and sector best practices.
1. Security-by-Design Architecture
Grantora is built on a security-first architecture hosted on Microsoft Azure (FRANCE).
Core principles:
End-to-end encryption (TLS 1.3 in transit, AES-256 at rest)
Separate organizational workspaces / isolated databases
Zero-retention AI inference (no training on customer content)
Role-Based Access Control (RBAC) enforced at all layers
Minimal-privilege access for operational staff
Sensitive operations, such as AI text generation, occur in zero-retention environments where inputs and outputs are not stored or reused.
2. Data Hosting & Compliance
All customer data is stored exclusively in the European Union (FRANCE).
Grantora complies with:
GDPR (EU 2016/679)
French Data Protection Act
CNIL recommendations
Cross-border transfers (if any) rely on Standard Contractual Clauses (SCCs) and supplementary safeguards.
Grantora acts as a Data Processor, and customers act as Data Controllers under GDPR.
A full Data Processing Agreement (DPA) is available.
3. Access Controls & Authentication
Unique user accounts; password strength requirements
Fine-grained RBAC: users only see data belonging to their organization
Internal staff access is strictly limited and logged
Administrative access requires secure credential management and audit controls
4. Application & Infrastructure Security
Azure-native security controls (KeyVault, Defender for Cloud, Monitor)
Regular vulnerability scanning
Segmented architecture with restricted network boundaries
Automated backups stored within EU regions
Protection against data loss, unauthorized access, and injection attacks
Security testing incorporated into development lifecycle
5. Logging, Monitoring & Incident Response
Continuous monitoring via Azure Monitor and Application Insights
Pseudonymized operational logs
Automated anomaly detection for suspicious activity
Formal incident-response procedures
Grantora will notify Customers of a confirmed personal data breach within seventy-two (72) hours of becoming aware of the incident, in accordance with GDPR Article 33
6. Subprocessor Controls
Grantora uses a small number of carefully selected subprocessors, including:
Microsoft Azure (FRANCE) – hosting, AI inference, monitoring
PayPal / Qonto – payment processing
Google Workspace – Email hosting and communication
Odoo (EU) – website and form submissions
All subprocessors undergo security and privacy reviews and operate under GDPR-compliant agreements.
A public Subprocessor Registry is maintained on our website.
7. Customer Data Ownership & Isolation
Customers retain full ownership of all content and AI outputs.
Customer documents are stored in isolated environments—never mixed between organizations.
Customer Content is never used to train AI models, internal or external.
Data deletion is available on request and at termination (after a 30-day export window).
8. Organizational Measures
Staff receive mandatory training in data protection, confidentiality, and secure operations.
Access to production systems is restricted to a minimal number of authorized engineers.
Internal policies govern data handling, retention, and incident reporting.
Grantora maintains a culture of privacy-by-design aligned with NGO risk profiles.
9. Commitment to Security & Continuous Improvement
Grantora continuously improves its security posture through:
ongoing risk assessments
security testing
architectural reviews
compliance audits
community and donor feedback
We recognize the sensitivity of work conducted by NGOs—particularly those operating in protection, human rights, women’s rights, and conflict-affected settings—and we design our controls accordingly.
10. Contact
For questions about this Acceptable Use Policy:
Grantora SASU
Email: [email protected]
Website: www.grantora.io