NGO Analytics
Data processing addendum
NGO Analytics processes personal data to run Grant Ops and Fiscal Sponsor OS. We are the processor; the customer workspace is the controller, unless a specific product email says otherwise. This page is how to request a signed DPA. It is not itself a signed contract.
Email [email protected] with subject DPA / security questionnaire. Attach your paper if you have one. We will countersign ours or yours.
What we tell funders and boards
Same terms as the signed DPA and order form. /dpa
- Customer content is not used to train NGO Analytics or any third-party model.
- No new AI vendor without updating /subprocessors.
- Optional LLM only under an API agreement that prohibits training and uses zero data retention where the vendor offers it.
- Consumer ChatGPT / Claude.ai are not subprocessors.
What the signed DPA will cover
- Subject: hosting and operating Grant Ops / Fiscal Sponsor OS.
- Duration: the subscription plus that customer’s retention setting (per organization; audit events ≥ 365 days). Empty means retain until they set a number or offboard.
- Data: staff emails, org facts (including EIN as entered), awards, uploads, audit metadata.
- No training: we do not use customer content to train our models or a vendor’s. Optional AI drafts are off until an admin enables them, and only on a contracted API with no-training / zero-retention terms.
- Subprocessors: the list at /subprocessors. We will not add a content-touching vendor without updating that list.
- Security: privileged MFA, RLS, TLS, host encryption at rest, audit, retention job.
- Breach: we notify affected workspace admins as soon as we have facts, within 72 hours for S1.
- Transfers: United States (Supabase, DigitalOcean NYC, SES us-east-1) unless we list another region.
- Governing law: the order form or, if none, Florida, USA.
We are preparing a SOC 2 Type II (Security, Availability, Confidentiality). We are not certified. When issued, the report is available under NDA from the same mailbox.