Last Updated: July 2, 2026 · Required for GDPR / SOC 2 compliance
Grants USA, operated by Astra Agency, uses certain third-party service providers ("sub-processors") to deliver our platform. In accordance with GDPR Article 28 and SOC 2 requirements, we maintain this list of all sub-processors that may process personal data on our behalf. We contractually require all sub-processors to implement appropriate data protection measures.
Stripe, Inc.
Payment processing, subscription billing, and fraud prevention
Location: United States
Wix.com
Application hosting, database, authentication, and file storage
Location: United States / Israel
Supabase, Inc.
File storage and static asset delivery
Location: United States
OpenAI, LLC
AI-powered grant writing, analysis, and content generation
Location: United States
Google DeepMind (Gemini)
AI model used for certain web-search augmented content tasks
Location: United States
Anthropic, PBC (Claude)
AI model used for complex grant writing tasks
Location: United States
Resend
Transactional email delivery (receipts, notifications, password resets)
Location: United States
Grants.gov (HHS/Federal)
Public federal grant opportunity data retrieval
Location: United States
We will notify customers of any new sub-processors or material changes to this list via email or platform notification at least 14 days before the change takes effect, giving customers the opportunity to object in accordance with their data processing agreement.
For questions about data processing, contact: privacy@grantsusa.io
