Subprocessors
Every third party that may touch your data while a panel runs, what it does, and where it operates. Institutions may treat this as the disclosure schedule to our DPA.
01 How this list works
A subprocessor is any third party that may process data on our behalf while GrantPanel runs. This page is the authoritative list, kept current and dated. Institutions evaluating GrantPanel may treat it as the disclosure schedule attached to our data processing agreement.
02 Model providers
Anthropic (United States) and OpenAI (United States) process the submitted proposal to produce compliance checks, written reviews, deliberation, and revisions. Which of the two handles a given step is set by our routing configuration; either may be used for any step, and one may stand in for the other if a call fails. Both are used through their commercial APIs, under terms that exclude submitted content from model training. OpenAI responses are requested without server-side storage. Each provider may keep request content for a limited period, typically up to 30 days, for abuse and safety monitoring.
03 Reference lookups
Semantic Scholar, operated by the Allen Institute for AI (United States), receives the titles and DOIs from your proposal's reference list, so the panel can check that each cited work exists and read its abstract. No other part of the proposal is sent, and no account information.
04 Hosting and storage
The application, its database, and the review workers run on Render (United States). Uploaded documents are held in encrypted object storage on Amazon Web Services (S3, United States) only while their run lasts, and are deleted when it ends.
05 Authentication, email, and payments
Sign-in is handled by Clerk (United States), which holds your authentication credentials so that GrantPanel does not; if you choose Google sign-in, Google also takes part. Email is sent from the grantpanel.ai domain through Google Workspace (United States), which receives your email address and the message. Payments are processed by Stripe (United States); card details go directly to Stripe and never reach GrantPanel systems.
06 International transfers
The subprocessors listed here process data in the United States. For institutions that need them, we put Standard Contractual Clauses in place with our Data Processing Agreement.
07 Requesting the full schedule
Write to hello@grantpanel.ai for the dated version of this list, our data-flow summary, and the security questionnaire responses most institutions ask for.