AI, Security, and Vendor Risk FAQ for Boards

Use this FAQ to prepare a board, finance, IT, or vendor-risk review of GrantLink. It describes how the product works today. It separates that behavior from commitments that only GrantLink's contracts, Privacy Policy, and written security answers can make.

Review rule: The answers below describe current product behavior. They are not contract terms. Confirm retention, deletion, incident response, certifications, data location, service providers, and exit help in writing with GrantLink.

Before the review

Collect these items:

• The Intuit consent screen that appears when you connect QuickBooks, and the QuickBooks company you connect
• The GrantLink roles assigned to each person in your organization
• The QuickBooks write setting in Settings > QuickBooks > Permissions
• GrantLink's current Privacy Policy and Terms of Service, and any data-processing terms, service-provider list, or security questionnaire answers you receive
• The AI features and types of data your organization plans to use
• The exports you need to keep working if you stop using GrantLink
• The people who review accounting, reports, AI output, publication, and deletion

Summary

• GrantLink isn't your general ledger. It stores a copy of selected QuickBooks data and adds grant records such as budgets, allocations, receipts, releases, reports, files, and chats.
• QuickBooks access is read-only by default. An admin must allow each type of QuickBooks change, and a person must preview and apply each change.
• Chat works inside your organization. Chat can read your organization's records and use GrantLink tools. Viewers can't send chat messages or make changes.
• Most Chat changes need your approval. Chat explains a proposed change, and you select Approve or Do not approve. Chat doesn't write to QuickBooks.
• AI requests ask for no training and no data retention. GrantLink asks Vercel AI Gateway to use only providers that don't train on prompts and that have zero data retention agreements. The request setting doesn't replace contract terms or GrantLink's own retention rules.
• Exports are specific to each screen or task. GrantLink has many CSV, Excel, and PDF downloads, but it has no single export of all your organization's data.

What data does GrantLink store?

GrantLink stores two kinds of data.

QuickBooks connection and copied data

GrantLink stores:

• Details about the QuickBooks connection and sync, and the QuickBooks access tokens, which GrantLink encrypts before it saves them
• Classes, accounts, items, customers, departments or locations, projects, and vendors
• Transactions and their line details that grant and ledger features use
• Totals and reports that GrantLink calculates from that data

GrantLink uses this copy for its own features. QuickBooks stays the official record of your accounting, so fix accounting errors in QuickBooks and sync again. GrantLink doesn't store your QuickBooks username or password, because you connect through Intuit's sign-in.

Data created in GrantLink

GrantLink also stores your organization settings, the members of your organization, funders, initiatives, grants, budgets, allocations, receipts, restriction releases, reporting cycles, uploaded files, chats, report templates, reports and their outputs, and an audit log of changes.

Which outside services handle customer data?

The GrantLink code sends customer data to these services:

GrantLink also runs its own services that create and fill PDF and Excel files. The code doesn't show where those services are hosted.

The list above comes from the product, not from a contract. Ask GrantLink for its current list of service providers and their terms.

What QuickBooks access does GrantLink request?

By default, GrantLink requests these Intuit OAuth scopes:

• com.intuit.quickbooks.accounting
• project-management.project
• app-foundations.custom-field-definitions.read

GrantLink can change this list for its service, so check the scopes on Intuit's consent screen when you connect. Intuit's documentation explains what each scope allows.

Is GrantLink read-only for QuickBooks?

Yes, by default. Connecting and syncing QuickBooks don't write to QuickBooks.

A new organization starts with Read-only reporting, and every type of QuickBooks change is turned off. An organization with no saved setting also uses read-only.

An admin can choose Selected writebacks or Full writeback / automation in Settings > QuickBooks > Permissions. The setting alone doesn't change QuickBooks. A person must still preview and apply each change in GrantLink.

Which QuickBooks changes are available?

GrantLink has review steps for these types of change:

• Creating or updating the QuickBooks class, customer, or project that tracks a grant, and creating or updating the customer for a funder. Only admins can preview and apply these changes in GrantLink.
• Adding or clearing grant tracking on QuickBooks transactions. Admins and members can do this.
• Creating allocation journal entries and reversing journal entries. Admins and members can do this, and the QuickBooks books must use a single currency, US dollars.

Each type must also be allowed in your permission setting. GrantLink can turn a type of change off for its whole service, and your settings page doesn't show that. Test the exact change you need before you describe it as supported.

GrantLink can't make the following types of change today, even when the setting allows them:

• Making a funder's QuickBooks customer inactive or active again
• Indirect-cost journal entries
• Claim invoices
• Custom fields

For details, see QuickBooks Permissions and Current Writeback Availability.

What can AI access?

Only signed-in members of an organization with the Admin or Member role can send messages to Chat. Chat's tools act as the signed-in user, and every record read checks that the record belongs to the user's organization.

Depending on the request, Chat can read:

• Up to the 50 most recent messages in the conversation
• Grant, funder, initiative, budget, allocation, receipt, and report data
• QuickBooks data that GrantLink synced
• Files that a user uploads
• Report templates and reports that GrantLink created
• The AI assistant instructions that an admin saves in Settings > AI

Other AI features also send data to the AI model, for example reading award documents to create a grant, suggesting how to map CSV columns, writing allocation rules, reviewing spending pace, and classifying transactions.

Don't upload data only because it exists in QuickBooks. Apply your organization's rule for sharing the least data needed.

Organization checks lower the risk that one organization sees another's data. They don't replace your own review of user roles and the features you turn on.

Which AI models and providers does GrantLink use?

GrantLink sends AI requests through Vercel AI Gateway. The current code uses these models:

• OpenAI GPT-5.6 Luna for Chat, report drafting, document reading, and most other AI features
• OpenAI GPT-5.4 nano to suggest names for new QuickBooks tracking records
• A transaction review model that AI Gateway provides under the ID typesafe-ai/jev, for classifying and reviewing transactions, analyzing your accounting setup, and matching grants to QuickBooks records

GrantLink can change these models. Ask GrantLink for the current models and providers, because the code can't show which provider handled a specific request.

Are prompts or documents used to train AI models?

GrantLink asks AI Gateway to send each AI request only to providers that meet both of these conditions:

• The provider doesn't train on prompt data.
• The provider has a zero data retention agreement.

If AI Gateway can't find a provider that meets both conditions, the request fails. GrantLink doesn't send it to another provider.

GrantLink's AI settings page also states that your AI instructions don't train a model. The AI Gateway settings show what GrantLink asks for, but they don't prove each provider's compliance, the terms of each contract, or when a provider deletes data. Confirm those points in writing.

Does "zero data retention" mean GrantLink stores nothing?

No. The zero data retention setting applies to the AI provider. GrantLink itself stores chat messages, uploaded files, reports, report outputs, AI instructions, and audit records, so that your team can continue, review, download, and audit the work.

GrantLink's Privacy Policy says that GrantLink keeps account and organization data while your account is active and as long as reasonably needed for the purposes it lists. It also says that after an account closure or a verified deletion request, GrantLink deletes or de-identifies data unless it must keep it. Copies can remain in backups until the backups are overwritten.

Ask GrantLink separately about these items:

• How long it keeps workspace records
• What happens to deleted files and records
• Backups and disaster recovery copies
• Logs and audit records
• Legal holds
• Published report websites

Can AI write to QuickBooks?

No. GrantLink Chat has no tool that changes QuickBooks data. It can start a QuickBooks sync after you approve, and a sync only reads from QuickBooks.

QuickBooks changes happen only on GrantLink's own review screens, as described above.

How do AI approvals work?

Chat applies a few changes directly, such as edits to the organization's name, fiscal-year start month, timezone, or default indirect rate. GrantLink records those edits in its audit log.

For most other changes, Chat explains the exact change, and the user selects Approve or Do not approve. For example, the following changes need approval:

• Creating, updating, or archiving grants, funders, and initiatives
• Allocating transactions
• Editing a grant budget or budget mappings
• Starting a QuickBooks sync

An approval applies to one change only. If the request changes, Chat must ask for approval again. For budget edits, GrantLink rejects the edit if the budget changed after Chat read it. Text that the AI writes, such as "confirmed", doesn't count as an approval.

People must still review financial analysis, reports, calculations, and exports that AI creates, whatever the approval steps.

Does the ChatGPT integration share data?

GrantLink has an optional integration for ChatGPT. When a user connects it, ChatGPT can ask GrantLink for the user's organization data, such as grants, funders, initiatives, reporting cycles, sync status, financial summaries, and grant transactions. GrantLink then sends those records to OpenAI so ChatGPT can answer.

The integration also lets admins and members preview and apply a link between a grant and a QuickBooks tracking record. The link changes GrantLink data only, not QuickBooks.

Users can disconnect the integration in ChatGPT's settings. Decide whether your organization allows the integration before people connect it.

What roles and permissions matter?

GrantLink has three roles: Admin, Member, and Viewer.

• Viewers can see data, but they can't make changes or send chat messages.
• Only admins can change the QuickBooks write setting and the AI assistant instructions.
• Only admins can preview and apply changes to the QuickBooks records that track grants and funders.
• Only admins can invite firm clients, set up opening fund balances, and close or reopen a fund-balance year.
• Members and admins can do most other work, including publishing reports.

GrantLink doesn't have separate permission settings for each export, publication, deletion, or record type. Review your users' roles, and test important tasks with an admin, a member, and a viewer account.

What export and exit options exist?

GrantLink has these exports:

• Chat can create CSV or Excel files of grant summaries, funders, allocation history, transaction detail, unallocated transactions, budget versus actual, the reporting calendar, initiative spending, grant breakdowns by QuickBooks class, fund receipts, and custom data sets.
• You can download grant budget and portfolio workbooks, restriction release workbooks, and restricted fund workbooks.
• You can download report PDFs and prepared copies of funder templates.
• You can export the activity log as CSV or Excel.

The exports listed above don't add up to a full export of all your organization's data. Before you stop using GrantLink, take these steps:

1. Run a final QuickBooks sync.
2. Export the accounting detail you need from QuickBooks itself.
3. Download the GrantLink budgets, allocations, restricted fund data, releases, reporting calendar, and reports you need.
4. Download important uploaded files and funder templates.
5. Ask GrantLink whether it can export chats, notes, files, audit history, and other GrantLink records, and get the answer in writing.
6. Check that you can open the exported files and reconcile them outside GrantLink.

Don't assume that you can rebuild every GrantLink calculation or link between records from the current exports.

What does deletion cover?

Deletion in the app works one record at a time, for example a file or a grant. Deleting a record in GrantLink doesn't show that copies were removed from backups, logs, AI providers, or every related record.

Removal of a whole organization's data is a GrantLink staff task. The removal process makes no calls to QuickBooks or other providers, so it doesn't take down published report websites. Ask GrantLink how it removes published reports.

For your vendor review, ask GrantLink for written answers about these items:

• What a full organization deletion covers
• When backups expire
• Records that GrantLink must keep for legal reasons
• How GrantLink removes published report websites
• What evidence GrantLink gives when deletion is complete

How should we check the configuration?

1. Use a test organization when you can.
2. Check that Intuit's consent screen shows the scopes you expect.
3. Review Settings > QuickBooks > Permissions, and test the exact QuickBooks change you plan to allow.
4. Test access to Chat, exports, publishing, settings, and deletion with an admin, a member, and a viewer account.
5. Upload a test file that has no sensitive data, and check how Chat uses it.
6. Ask Chat for a change that needs approval. Confirm that nothing changes before you select Approve, and that a changed request needs a new approval.
7. Export each type of record you need to keep and reconcile the result.
8. Compare what you see with the contract, the Privacy Policy, the security questionnaire, and the service-provider list, and record any differences.

What should stay a contract or security question?

The product can't answer these questions. Get current written answers from GrantLink:

• Security certifications, penetration tests, incident response commitments, and breach notice periods
• Contract terms with AI providers and other service providers
• Where data is stored and how encryption keys are managed
• Whether AI providers comply with the no-training and zero data retention settings
• How long GrantLink keeps workspace records, logs, and backups
• Help with exports and its service levels
• Access to published report websites
• Whether deleting an organization removes everything

Summary statement for a board

GrantLink stores a copy of selected QuickBooks data and the grant records that your organization creates. QuickBooks access is read-only by default. Changes to QuickBooks need an admin's permission setting, a supported type of change, and a person who previews and applies each change. GrantLink sends AI requests through Vercel AI Gateway and asks it to use only providers that don't train on prompts and that have zero data retention agreements. Chat uses your organization's data and uploaded files for each task, and most changes it proposes need a user's approval. The controls described here don't replace human review or written answers from GrantLink about retention, service providers, security, deletion, and exit help. GrantLink has many exports for specific tasks, so test them, and confirm with GrantLink how to get any other records you need.