// Trust & Security Report
Grammarly
by Superhuman Platform Inc. (formerly Grammarly)
AI-powered writing assistance and productivity platform. Consumer tiers: Free, Premium, Pro; enterprise tier: Enterprise. Additional products: Superhuman Go (productivity agents), Superhuman Mail (email), Grammarly for Education, Docs.
Certifications held
10
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on grammarly.com“SOC 2 (Type 2) examinations validate that Grammarly meets the strict SOC 2 standards for security, availability, confidentiality, and privacy”
Verify on grammarly.com“SOC 3 - Public report describing validated controls; available as of 2023”
Verify on support.grammarly.com“Certificate dated June 23, 2025. Confirms Grammarly has established, implemented, maintained, and continually improving an information security management system”
Verify on support.grammarly.com“Certificate dated June 23, 2025. Demonstrates compliance with security requirements for cloud service providers and customers”
Verify on grammarly.com“Covers protection of users' personal information in cloud environments”
Verify on grammarly.com“Privacy information management system. Verifies Grammarly meets requirements for privacy information management”
Verify on grammarly.com“Responsible AI development and use requirements. ISO 42001 certification active as of 2023, demonstrating AI governance maturity”
Verify on grammarly.com“Payment card industry data security standard - Active compliance”
Verify on superhuman.com“Grammarly complies with GDPR via ISO 27701 and certifies compliance with EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework (cert at dataprivacyframework.gov)”
Verify on grammarly.com“Grammarly is HIPAA compliant. Users must not store, transmit, or process Protected Health Information unless they have entered into a Business Associate Agreement (BAA) with Grammarly”
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
US East (AWS) with international transfers. EU/UK/Swiss users covered by Data Privacy Framework
Grammarly can use customer data to train AI models by default for Free/Premium/Pro tiers. OFF by default for Enterprise, Business, and Education tiers. Users can disable via Product Improvement and Training control in account settings. Grammarly restricts third-party AI service providers from training on customer content.
// Security controls
Infrastructure
Amazon Web Services (US East region) with native backup tools, load balancers, and web application firewalls
grammarly.comVulnerability management
Third-party penetration testing and HackerOne bug bounty program
grammarly.comData ownership
User words are owned by users; Grammarly does not sell or monetize user content
grammarly.com// Products & data scope
Data it handles: User writing content for grammar/clarity checks
AI training enabled by default. Basic writing features. No cost.
Data it handles: User writing content including tone and style suggestions
AI training enabled by default. Advanced suggestions, tone detection, plagiarism checker.
Data it handles: User writing content with team collaboration
AI training ON by default for single-user and web-purchased plans; OFF by default for Sales-team purchases. Generative AI features, style guides, team collaboration.
Data it handles: Organization writing content with confidential mode option
AI training OFF by default. Confidential mode, granular permissions, data loss prevention, unlimited users, dedicated support.
Data it handles: Workspace/document data for AI-powered workflows
Part of Superhuman Platform acquisition. Productivity agents for docs and workflows.
Data it handles: Student writing submissions
AI training OFF by default for all education accounts.
// What to watch
- Grammarly has been acquired by and merged into Superhuman Platform Inc. Privacy policy and DPA inquiries now redirect to the Superhuman domain; verify the ongoing separation of product tiers.
- Consumer Free, Premium, and Pro tiers have AI training enabled by default. While opt-out is clearly available, this differs from the Enterprise posture, where training is off by default, so tier selection matters during procurement.
- Primary infrastructure runs in AWS US East. While DPA compliance is stated, EU/UK users should confirm data localization requirements.
- HIPAA compliance is conditional on executing a Business Associate Agreement. It is not a default feature; users must request and execute the agreement.
// At a glance
Pricing model
Freemium (Free tier + Premium monthly/yearly + Pro + Enterprise contact sales)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Superhuman Platform Inc. (formerly Grammarly)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-07. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
grammarly.com