Version 1.1 · Effective 2026-07-13
Trust
You're about to put your donor list, your grant deadlines, and your budget into software built by a small company. That deserves a straight answer to five questions, not a wall of badges.
Here are the short answers. Each one links to the long answer.
Is my data separated from other nonprofits' data?
Yes, at the database level, not just in the code. Every row of every table carries an organization ID, and Postgres row-level security refuses to return a row to anyone outside that organization. It's enforced in the database, so a bug in the application can't leak past it.
Does an AI train on my donor data?
No. BloomOS sends data to Anthropic's Claude API only when you ask it to, for things like funder research and drafting. Anthropic's commercial terms prohibit training on that data, and it's deleted from their systems within 30 days. We have not opted in to any program that would change that.
Who can actually see my data?
Your team, under the permissions you set. Plus one person at SOBO Consulting who can reach the production database for support and repair, and does so only when you ask or when something is broken. Every meaningful change in BloomOS is written to an audit log.
Is my data mine? Can I leave?
It's yours. You can export everything at any time, in CSV. If you cancel, we keep it for 30 days so you can change your mind, then we delete it.
What happens when something breaks?
You email us. If something is broken and you can't work, you hear back within one business day. If we ever have a security incident affecting your data, you hear from us within 72 hours, and you hear the specifics.
Read about availability and support
The documents
- Security overview
- How BloomOS uses AI
- Your data: ownership, export, deletion
- Availability and support
- Subprocessors
- Privacy policy
- Accessibility
What we're still building
We don't have SOC 2 or an ISO certification yet, and our first third-party penetration test is planned but hasn't happened. We're a small team, and we built the protections that matter most first: database-level isolation, encryption, an append-only audit log, and a real nonprofit running on the system every day.
Small nonprofits get sold vague assurance constantly. We'd rather show you specifics and let you decide.
Questions we haven't answered here: hello@bloomos.org. Security issues: security@bloomos.org.