Submit.com Security, Privacy and Compliance for Application Programmes
Submit.com grant management software security protects every form, file, review and decision with encryption, role-based access, audit trails and independently audited controls, for grant, scholarship, awards and talent programmes across government, education, foundations and non-profits.
Built to Keep Data Safe
Security, integrity, and confidentiality are foundational to Submit.com. Our platform combines strong encryption, robust identity controls, continuous backups, and comprehensive auditability to protect your organisation’s data end to end.
- Customer data is not copied, shared or changed without your authorisation, and Submit.com does not edit or delete data on your platform unless you direct it to.
- Encryption in transit (TLS 1.2 or above) and at rest across forms, files and exports.
- Least-privilege, role-based access with granular permissions and separation of duties.
Security Certifications and Current Status
Procurement teams need to know not only what a supplier claims, but where the evidence is and when it was last checked. This table separates publicly verifiable listings from documents Submit.com provides on request.
| Control | Submit.com capability | Evidence | Last verified |
|---|---|---|---|
| SOC 2 Type 1 | Independent attestation that security controls are suitably designed | Audit completed through Thoropass. Report available from the Submit.com team on request | Report date to be confirmed by Submit.com |
| SOC 2 Type 2 | Independent attestation that controls operated effectively over a review period | Audit completed through Thoropass. Report available from the Submit.com team on request | Report date to be confirmed by Submit.com |
| Cyber Essentials | Certified against the UK government-backed scheme's five technical controls | Declared in Submit.com's G-Cloud 14 service listing. Current certificates can be checked on the IASME certificate search | Listing checked 28 October 2026. Certificates renew yearly |
| HM Government G-Cloud | Listed supplier on G-Cloud 14, Lot 2 cloud software, service ID 747443801367611 | Digital Marketplace listing | Checked 28 October 2026 |
| Data location | Data stored and processed in the United Kingdom and the European Economic Area | Declared in the G-Cloud 14 service listing | Checked 28 October 2026 |
| Encryption in transit | Transport Layer Security (TLS) 1.2 or above between your network and Submit.com, and within Submit.com's network | Declared in the G-Cloud 14 service listing | Checked 28 October 2026 |
| Encryption at rest | Encrypted storage for forms, files, media and exports | Submit.com security documentation | To be confirmed by Submit.com |
| Penetration testing | External penetration testing at least every six months | Declared in the G-Cloud 14 service listing | Checked 28 October 2026 |
| Staff screening | Staff security screening conforms to BS 7858:2019 | Declared in the G-Cloud 14 service listing | Checked 28 October 2026 |
| Audit logging | User activity audit information available in real time and kept for at least 12 months | Declared in the G-Cloud 14 service listing | Checked 28 October 2026 |
| Backups | Real-time replication and daily database snapshots | Submit.com security documentation | To be confirmed by Submit.com |
On smaller screens, scroll the table sideways to see every column. Submit.com is listed on G-Cloud 14; check the Digital Marketplace for its status on later frameworks.
Role-Based Access and Administrative Controls
Role-based permissions for team leaders, team members and external reviewers, with permissions set by team leaders.
Two-factor authentication for users and administrators, with strong password policies.
Single Sign‑On (SSO) options for social and enterprise identity providers (plan dependent).
Session management, account controls, and configurable timeouts.
Compliance by Design
Operate with confidence under strict regulatory and governance requirements.
A data processing agreement, privacy dashboard and configurable data retention support your General Data Protection Regulation (GDPR) obligations.
Data Resilience & Continuity
Your programmes can’t pause, neither can your data protection.
- Real‑time replication to protect against data loss.
- Daily database snapshots for point‑in‑time restoration.
- Integrity checks and monitored backup operations.
- Export options for secure archival and governance needs.
Secure by Default
Your programs can’t pause, neither can your data protection.
- Encrypted file storage for documents, media, and form uploads.
- Protection is switched on from the start.
- Fine‑grained visibility: restrict data by program, department, category, or role.
- Optional anonymisation/blind review to minimise exposure of personally identifiable information (PII).
Audit Trails and Retention
Demonstrate accountability with clear, exportable evidence.
- Audit trails for submissions, reviews, decisions and administrator actions, with user activity available in real time.
- Reporting for compliance reviews, board oversight and external audits.
- Configurable data retention and deletion aligned to your institution’s requirements.
Customer Data Ownership
Data belongs to customers always.
- You retain ownership of all data stored in Submit.com, including forms, documents, and media.
- We never access data without explicit authorisation.
- No secondary uses, profiling, or data sharing.
- PAt the end of a contract, export your data as CSV files; it is then transferred or deleted as you choose.
Applicant, Student and Employee Privacy
Application programmes collect personal, financial and sometimes sensitive information about people who are not your customers. Submit.com gives you the controls to tell them how it is used and to limit who sees it.
Your privacy dashboard
Each workspace has a privacy dashboard where your organisation sets out its own privacy statement and acceptable use policy, records which types of personal data it collects, and declares any special category data processed under Article 9 of the General Data Protection Regulation (GDPR).
When those policies change, applicants are asked to accept the latest versions the next time they sign in. Your team also agrees the data processing agreement and data retention policy that govern Submit.com's role as your processor.
Limiting who sees personal data
Folder settings hide applicants' names and contact details from reviewers, and individual questions, such as income or health information, can be hidden from reviewers' folders. External reviewers only ever see the applications shared with them.
Submit.com sets only the cookies that are strictly necessary for the service a user has asked for, such as keeping their session signed in.
Grant applicants
Organisation and financial details, due diligence answers kept to internal staff, and retention periods that match funding audit requirements.
Students
Household income, residency and, where relevant, disability or health information, hidden from scholarship reviewers who do not need it.
Candidates and employees
CVs, certificates and personal details for talent programmes, visible only to the people running the process.
At the end of a contract, you can export your data as CSV files, and Submit.com transfers or deletes it as you choose. Submit.com does not edit or delete data on your platform unless you tell it to.
Certifications & Accreditations
SOC 2 Type 1 Certified
SOC 2 Type 2 Certified
GDPR Compliant
G-Cloud Listed Supplier
AWS Technology Partner
Cyber Essentials Certified
Shared Responsibility
Security and compliance are a partnership. Submit.com provides secure infrastructure, features, and controls; organisations maintain appropriate configurations, access policies, and operational practices that align with their regulatory obligations.
Get the Details
- Architecture and controls overview
- Identity & access configuration guide
- Backup and recovery procedures
- Compliance mappings and FAQs
Have a specific requirement or questionnaire? Our security and customer success teams will collaborate with administrators and IT to validate controls, complete assessments, and support a smooth, compliant rollout.