How we keep your information safe

Last updated: October 29, 2026

Grant Desk holds sensitive information about your organization. Here's how it's protected, in plain language.

Your desk is yours alone

• Every request is checked by our server: people see only the desks they've been invited to. Each organization's data is kept separate.
• Uploaded files can be opened only by people on that desk, and are served in a way that stops them from running code in your browser.
• You decide who joins your desk, and anyone can be removed at any time.

You can see when Ravel looks

• Ravel can open your desk to help you, under our mutual confidentiality agreement.
• Each time someone from Ravel opens your desk, your shared files or a document, it's listed on your Profile page. Every change anyone makes is recorded in History and can be undone.

Signing in

• You sign in with Google. We never see or store your password. Turn on 2-step verification in your Google account for extra protection.
• Only people who've been invited can sign in to a desk. Invitation links work once and expire after 14 days.

Google Drive and Gmail

• Google Drive: Grant Desk can read only the files you pick, nothing else in your Drive.
• Gmail (optional): if you connect it, Grant Desk reads your mail only to look for funding updates when you ask it to, with read-only access. It can't send, change or delete email, and nothing changes in your desk until you approve it.

AI

• Claude (by Anthropic) helps research programs and draft answers. Information sent to it is used only to produce that answer and is not used to train AI models.
• AI drafts are always marked as drafts until someone on your team confirms them. Grant Desk never submits applications or sends emails on its own.
• If you connect your own AI agent, its key reaches only your desk, every change it makes is recorded, and it can't send email, submit, delete or change who has access.

What we never store

Passwords, verification codes, bank or loan account numbers, personal health or personal financial information, or individuals' home addresses.

In transit and at rest

• All traffic to Grant Desk is encrypted (HTTPS), and browsers are told never to connect without it.
• The app is hosted on Replit; data and files are stored in its managed database. Our service providers are listed in the privacy policy.
• Pages are protected against being embedded by other sites, and changes are accepted only from Grant Desk's own pages.

Independent review

We review Grant Desk's security regularly, including independent reviews of the code, and fix what we find. The most recent review was in October 2026.

If something goes wrong

If a breach of security safeguards creates a real risk of significant harm, we will notify the people affected and the Office of the Privacy Commissioner of Canada, as the law requires. To report a security concern, email sameena@ravelstrategygroup.com.