GRANTS
Security

Straight answers on data, AI and what we will never do.

Short version: your data is stored in Australia, AI analysis runs through OpenAI under a no-training arrangement, your guideline documents are private to your account, and Helm never submits anything on your behalf. The detail, with nothing rounded up:

Where your data lives

Your account, organisation profile, saved rounds and pipeline live in Supabase's Sydney region (AWS ap-southeast-2). The application itself runs on a server in Sydney. Two categories of data leave Australia in transit to processors: payment details go to Stripe, and text being scored or drafted is processed by OpenAI in the United States. Neither is stored by us offshore. This is the same statement our legal page makes, because there is only one version of the truth.

What the AI sees, and what it never does

  • What is sent: your profile facts and the text of grant rounds and guideline documents being scored, read or drafted are sent to OpenAI for analysis. That is the whole list.
  • No training: our API usage is not used to train OpenAI's models, per their API data-usage terms.
  • No invention: drafted text must trace to your profile, the round's own documents, or stay behind a visible [CONFIRM: ...] marker. Guideline reads quote their evidence verbatim with the source document. An automated audit runs against every release.
  • No eligibility rulings: Helm surfaces the guidelines' own who-may-apply rules and can propose a reading; the verdicts are always yours.

Public registers, used honestly

Helm can check your entity type against the Australian Business Register and your ABN against a weekly mirror of the ACNC Charity Register (CC BY 3.0 AU). A register hit is stated as found-as-at its snapshot date; absence from the snapshot is never stated as "not registered". Grant-award context comes from GrantConnect's published notices, shown with the Department of Finance attribution they require.

Your guideline documents

Documents you upload live in a private bucket, are served only through your authenticated session, are never shared across accounts, never enter anyone else's matching, and are deleted 90 days after the round closes. You bring your own copies; Helm never fetches portal documents for you.

What Helm will never do

  • No automated submissions. Helm prepares; you submit.
  • No apply/don't-apply verdicts. Helm states evidence and gaps; the decision is yours.
  • No funding probabilities. A match score states fit, never odds.
  • No data from restricted portals. Helm indexes sources whose terms permit it, shows the licence line on every record, and asks first everywhere else.

Provenance on every record

Every round in Helm carries a source line: which portal, under what licence, read when, with a link back to the official listing. Sample data is labelled as sample data.

Certifications

None yet claimed. Helm is an early-stage product and we will not decorate this page with a roadmap dressed as an achievement. When a certification is audited and held, it will appear here with its scope and date. Ask us anything specific through the contact form.