AI, Security, and Vendor Risk FAQ for Boards

Use this FAQ to prepare a board, finance, IT, or vendor-risk review of the current GrantLink product. It distinguishes controls visible in the application code from commitments that must come from current contracts, privacy notices, security materials, and subprocessor documentation.

Review rule: Treat the code-backed statements below as descriptions of current product behavior, not as contractual warranties. Confirm retention, deletion, incident response, certifications, data residency, subprocessors, and service-exit assistance in GrantLink's current legal and security materials.

Before the Review

Collect:

• The production Intuit OAuth consent screen and connected QuickBooks company
• The organization's GrantLink role assignments
• Settings > Permissions for the organization's QuickBooks write policy
• The current privacy notice, data-processing terms, subprocessor list, and security questionnaire
• The AI features and data types the organization intends to use
• Required continuity and exit exports
• Internal reviewers responsible for accounting, reports, AI output, publication, and deletion

Executive Summary

• GrantLink is not the general ledger. It mirrors selected QuickBooks data and adds grant-management records such as budgets, allocations, receipts, releases, reports, files, and chats.
• QuickBooks company-data writeback is currently blocked. The stored policy model still describes read-only, selected, and full modes, but backend enforcement fails closed for all QuickBooks company-data mutations during the control-plane rebuild.
• AI operates inside an authenticated organization context. It can read scoped data and use supported GrantLink tools; read-only viewers are blocked from the primary AI chat.
• Sensitive organization-agent changes use persisted plans where that tool contract applies. Lower-risk GrantLink writes may execute directly after server authorization. A plan is not a blanket approval mechanism for every product write.
• AI Gateway requests include no-training and zero-retention routing requirements. Those application settings are not proof of provider contracts, GrantLink workspace retention, backup deletion, or subprocessor terms.
• Exports are workflow-specific. GrantLink provides several CSV/XLSX, workbook, report, and PDF downloads, but the code does not establish a complete organization-wide exit export.

What Data Does GrantLink Store?

GrantLink stores two broad categories.

QuickBooks connection and mirrored data

Current schema and synchronization code include:

• Connection metadata, authorization evidence, sync state, and encrypted OAuth credentials
• Classes, accounts, items, customers, departments/locations, projects, and vendors
• Posting transactions and line-level accounting fields used by grant and ledger workflows
• Derived ledger and reporting projections
• Some deprecated QuickBooks budget-mirror records that may remain for compatibility

GrantLink uses the mirror for its own workflows; it does not become the authoritative QuickBooks ledger. Correct source-controlled accounting errors in QuickBooks and sync again.

GrantLink-native data

Current schema includes organization configuration, users' organization context, funders, programs, grants, budgets, allocations, receipts, restriction releases, reporting cycles, uploaded-file/workbook records, chats and runs, report templates, generated reports and outputs, persisted plans, and audit/activity records.

Uploaded or generated content may also be held in file storage. The source code alone does not establish retention duration, backup treatment, geographic location, or deletion timing for these records.

What QuickBooks OAuth Scopes Are Requested?

The code default requests:

• com.intuit.quickbooks.accounting
• project-management.project
• app-foundations.custom-field-definitions.read

Deployment configuration can replace the complete scope string. Verify the actual production request in Intuit's consent screen rather than relying only on this list. Intuit's current documentation is authoritative for the meaning of each scope.

Is GrantLink Read-Only for QuickBooks?

For current company-data mutations, yes. Connection and synchronization remain separate from writeback.

New organizations created through current setup paths receive a policy with:

• read_only mode
• Every write permission disabled
• Preview required for writes

Existing organizations with no explicit policy also resolve to that read-only default. The previous assumption that a missing legacy policy grants full access is not true in the current implementation.

Most importantly, the backend currently rejects every QuickBooks company-data mutation even when an administrator stores Selected or Full in the policy. The user-facing policy describes the intended authorization model but does not override the fail-closed control-plane block.

What Writeback Categories Exist in the Stored Policy?

The policy model contains categories for:

• Creating or updating grant entities
• Creating or updating funder customer records, including deactivate/reactivate operations
• Updating or clearing transaction grant tags
• Creating allocation journal entries
• Creating reversing journal entries
• Creating indirect-cost journal entries
• Creating claim invoices
• Updating custom fields

These categories do not represent currently available company-data writes while the global block is active. Do not approve a workflow on the assumption that changing the mode to Selected or Full will enable it.

Only organization administrators can update this policy. Confirm the displayed setting for governance purposes, but test the exact required workflow before documenting it as supported.

What Can AI Access?

The primary AI chat requires a signed-in user with organization context and rejects the read-only viewer role. AI tools receive request-scoped authentication, and the Convex functions they call enforce organization or resource ownership.

Depending on the active tool set and request, AI may receive or retrieve:

• A bounded projection of recent conversation history
• Grant, funder, program, budget, allocation, receipt, and report data
• Synced QuickBooks records exposed by read tools
• Uploaded documents and workbook content
• Report templates and generated outputs
• Organization AI instructions configured by an administrator

Current chat routing can send uploaded-file and report-work turns to the configured Anthropic work model. Do not upload information merely because it exists in QuickBooks; apply your organization's minimum-necessary data policy.

Authentication and organization-scoped helpers reduce cross-organization access risk, but they are not a substitute for reviewing every enabled tool and production role assignment.

Which Models and Providers Are Used?

GrantLink routes current AI inference through Vercel AI Gateway. Code-defined model routes currently include:

• Z.ai GLM 5.2 for primary chat and several analysis tasks
• Anthropic Claude Sonnet 4.6 for report/file work and document extraction
• Google Gemini 3.1 Flash Lite for initiative composition

Model routing can change with the application. Gateway eligibility and routing also do not prove which underlying provider served a specific production request. Obtain the current provider and legal subprocessor list from GrantLink's security materials.

Are Prompts or Documents Used for Model Training?

Reviewed inference paths pass Vercel AI Gateway provider options requesting:

• disallowPromptTraining: true
• zeroDataRetention: true

The application is designed to fail closed when Gateway cannot find an eligible route rather than silently relax those settings.

These are application routing controls, not a complete retention statement. They do not by themselves prove provider compliance, contractual no-training terms, deletion timing, or handling by every subprocessor. Verify those points in current contracts and security documentation.

Does “Zero Data Retention” Mean GrantLink Stores Nothing?

No. The Gateway option concerns provider-route eligibility. GrantLink may persist chat messages, runs, uploaded files, generated reports, report outputs, plans, organization AI instructions, and audit records so authorized users can continue, review, download, or audit work.

The code does not establish a customer-facing retention schedule or backup purge period. Ask separately about:

• Workspace record retention
• Deleted-file and deleted-record handling
• Backups and disaster recovery copies
• Logs and audit events
• Legal holds
• External published report deployments

Can AI Write to QuickBooks?

The primary AI tool set does not expose a general direct QuickBooks company-data write tool. Some approved organization plans can schedule a QuickBooks sync or reach a policy-gated customer-creation path, but the backend's global block still rejects QuickBooks company-data mutations.

AI cannot bypass that block or the authenticated organization boundary. Reassess this answer if the control-plane rebuild is completed and writeback is re-enabled in a future release.

How Do AI Approvals Work?

Sensitive organization-agent operations use persisted preview/apply plans when their tool contract requires it. A plan binds the organization, actor, operation payload, digest, risk, source state, and expiration. Applying a sensitive plan requires a qualifying human approval message tied to the same chat/run provenance; apply reauthorizes, checks stale state, and records an idempotent receipt.

Not every AI-assisted GrantLink write uses a persisted plan. Lower-risk reversible writes may execute directly under server-side authorization. Human review of generated financial analysis, reports, calculations, and exports remains required regardless of execution contract.

What Roles and Permissions Matter?

Current backend role behavior includes:

• Read-only viewers are blocked from AI chat and write operations.
• Organization administrators manage QuickBooks writeback policy and organization AI instructions.
• Some firm-client invitation and fund-balance setup actions are administrator-only.
• Many ordinary resource operations use authentication plus organization ownership rather than a separate admin permission. In the inspected backend, report publish, unpublish, and delete are not admin-only.

The code does not establish distinct configurable permissions for every export, publication, deletion, or record type. Review production Clerk roles and test each consequential workflow with representative admin, member, and viewer accounts.

What Export and Exit Options Exist?

Implemented exports include workflow-specific CSV/XLSX downloads for grant summaries, funders, allocation history, transaction detail, unallocated activity, budget-versus-actual data, reporting calendars, program spending, grant/QuickBooks-dimension breakdowns, and supported custom scopes. Grant budget/portfolio workbooks, release and fund-balance workbooks, generated report PDFs, and per-grant report-template workbooks are also available in their respective workflows.

These capabilities do not amount to a complete organization-wide export. Before termination:

1. Run a final QuickBooks sync.
2. Export the required accounting detail from QuickBooks itself.
3. Download GrantLink budget, allocation, restricted-fund, release, reporting-calendar, and generated-report outputs needed for continuity.
4. Download important uploaded files and template workbooks.
5. Confirm support-assisted extraction, if offered contractually, for chats, notes, files, plans, audit history, and other GrantLink-native relationships.
6. Test that the exported package can be opened and reconciled outside GrantLink.

Do not claim that every GrantLink calculation or relationship can be reconstructed from the currently implemented exports.

What Does Deletion Cover?

Deletion is resource-specific. The backend includes operations for records such as reports, uploaded files/storage, and grants, but those operations do not prove immediate removal from backups, logs, generated deployments, AI providers, or every derived record.

For vendor review, request written answers for organization-wide deletion scope, backup expiry, legal-retention exceptions, external deployment cleanup, and completion evidence.

How Should We Verify the Configuration?

1. Use a non-production test organization when practical.
2. Confirm Intuit's consent screen shows the expected production scopes.
3. Review Settings > Permissions and verify the current company-data write block with the exact intended workflow.
4. Test admin, member, and viewer access to chat, exports, publication, settings, and deletion.
5. Upload a non-sensitive test file and identify which AI route handles the task.
6. Review a sensitive preview/apply operation and confirm the plan cannot apply without qualifying approval or after stale state.
7. Export each record class required for continuity and reconcile the result.
8. Compare observed behavior with the contract, privacy notice, security questionnaire, and subprocessor list; document any difference.

What Should Remain a Contract or Security-Review Question?

The repository cannot conclusively answer:

• Security certifications, penetration tests, incident-response commitments, or breach notice periods
• Provider and subprocessor contractual terms
• Data residency and encryption key-management policy
• Provider compliance with no-training and zero-retention requests
• Workspace, log, backup, and deletion retention periods
• Support-assisted export scope or service levels
• External report deployment access guarantees
• Organization-wide account deletion completeness

Request current written evidence for these items rather than inferring them from product controls.

Plain-English Board Statement

GrantLink mirrors selected QuickBooks data and stores grant-management records for authenticated organizations. Current backend enforcement blocks QuickBooks company-data writes even though an intended writeback policy remains configurable. AI runs through Vercel AI Gateway with no-training and zero-retention eligibility requirements, uses authenticated tools and bounded conversation context, and may process uploaded files and organization data needed for a task. Those controls do not replace human review or contractual answers about retention, subprocessors, security, deletion, and exit assistance. GrantLink offers multiple workflow-specific exports, but organizations should test them and separately confirm how to extract all GrantLink-native records needed for continuity.