Where your data lives, who touches it, and what we have not done yet.

Updated October 31, 2026 by Alleviate. Facts carry the date they were true.

Alleviate hosts all customer data in the United States, encrypts it in transit, protects administrative access with multi factor authentication, never uses organization data to train AI, and does not yet hold a SOC 2 report or an ISO 27001 certificate.

Hosting and encryption

The web application runs on Vercel, the API on Heroku and the database on MongoDB Atlas, all in United States regions. Traffic is encrypted in transit with TLS. The database provider encrypts stored data at rest. Uploaded documents are stored with Cloudinary and served over HTTPS.

Access

Administrative accounts at Alleviate and at its providers (Google Workspace, GitHub, Vercel, MongoDB Atlas, Stripe, SendGrid, the domain registrar) require multi factor authentication, enforced at the organization level where the provider supports it. Production credentials are held in the hosting providers’ configuration. Inside the platform, access is by role and by capability: a team member sees what the organization’s administrator grants, and a funder sees only what an organization chooses to share, which is off by default.

What the AI sees

Kay and the drafting features send the relevant parts of an organization’s own record to the model provider to produce an answer for that organization’s own users. Neither Alleviate nor the providers use that data to train models. Kay always identifies itself as an AI assistant, flags gaps before it drafts, and a person records approval before a proposal, a donor appeal, a report or a consequential recommendation leaves the system. More in Does Alleviate use my data to train AI?

Processors

The services that process customer data on Alleviate’s behalf, as of the date above. Marketing site tags run on alleviate.org only; a customer’s own published website carries none of them.

Your data, your rights

The organization owns its data. Each module exports to CSV; an administrator can close the account from Settings, after which the organization’s data is removed on the schedule in the privacy policy. The data processing addendum covers organizations subject to the GDPR, POPIA and similar laws, including transfers to the United States. The Alleviate Index publishes only what is in the public IRS record (city and state, never a street address) until an organization claims its profile and adds its own words.

The security program, and what is not done

Alleviate adopted a written information security program on October 28, 2026, with a dated schedule for the controls still being completed. Alleviate has not undergone a SOC 2 audit and holds no ISO 27001 certificate; organizations that require either should ask for the program and the schedule before signing. Penetration testing by a third party is on the schedule, not yet done. This page is updated when any of that changes.

Reporting a vulnerability

Write to support@alleviate.org with the steps to reproduce. Alleviate answers within two business days, does not pursue researchers who test in good faith against their own accounts, and credits a fix where the reporter wants credit.