AI tools and client data
Is Grammarly safe for client data?
Short answer: Whether Grammarly is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Free and Pro (personal account), Grammarly may use what staff type to train its models unless somebody turns that off; on Business and Enterprise, we did not find a statement about model training in the pages we read. Every fact on this page is Grammarly's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.
See which AI tools your staff usePlan by plan, in Grammarly’s own words
A writing assistant that sits in the browser and in desktop apps, which means it reads the email or letter as it is being written.
| What you are asking | Free and Pro (personal account) | Business and Enterprise |
|---|---|---|
| Trains the vendor's models by default | Yes. The policy served at Grammarly's privacy URL lists training AI models among the uses of collected information.“We also use information we collect to train our AI models.” source, read | Not found in the pages we read. |
| How to turn training off | There is a training control in account settings. Note the policy at this URL is written in Superhuman's name, not Grammarly's.“You can decide whether Superhuman can use your user content to train our AI models by adjusting the available training control(s) in your account settings.” source, read | Not found in the pages we read. |
| How long data is kept | No period is published; the policy states a purpose test and says it varies by data type and settings.“We retain personal data for as long as necessary to provide our products to you” source, read | Not found in the pages we read. |
| What an admin can see or control | Not found in the pages we read. | An admin adds, removes and transfers accounts and sets roles and permissions.“Administration tools make it easy to add, remove, or transfer accounts and to manage team member roles, permissions, and access within your company.” source, read |
| Single sign-on | Not found in the pages we read. | SAML, on Business and Enterprise.“SSO allows for access management and enforcement of company-specific controls through integrations with identity providers.” source, read |
| Business Associate Agreement | Not found in the pages we read. | Grammarly says it will sign one on request, and does not say which plans qualify.“If you need to sign a BAA in order to comply with HIPAA, please submit your request here.” source, read |
| Where the data is processed | Not found in the pages we read. | Not found in the pages we read. |
An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Grammarly pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Grammarly before client information goes near it.
What this means for
The duty does not change because the tool is new. What changes is where the client information ends up.
- Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
- Dental and medical practices. Grammarly publishes a BAA position for this product, which is where that conversation starts. See dental practices.
- CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
- Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
- Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.
How to tell which version your staff use
The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.
1. Ask
Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.
2. Look at the billing and the admin console
This finds what the business pays for. It does not find a personal account, which is the one that matters here.
3. Look on the computers
A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.
Settings to check today
From Grammarly’s own documentation. Each one is a change somebody can make this afternoon.
- Find the training control in account settings and set it on every account that drafts client correspondence.“AI training control. As described above, you can decide whether Superhuman can use your user content to train our AI models” source, read
Questions we get asked
Is Grammarly safe for client data?
Whether Grammarly is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.
On Free and Pro (personal account), Grammarly may use what staff type to train its models unless somebody turns that off; on Business and Enterprise, we did not find a statement about model training in the pages we read.
Every fact on this page is Grammarly's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.
Does Grammarly train its models on what our staff type into Grammarly?
On Free and Pro (personal account), Grammarly may use what staff type to train its models unless somebody turns that off; on Business and Enterprise, we did not find a statement about model training in the pages we read.
On Free and Pro (personal account): Yes. The policy served at Grammarly's privacy URL lists training AI models among the uses of collected information.
Grammarly's own words: "We also use information we collect to train our AI models." (read 2026-11-02). On Business and Enterprise: Not found in the pages we read.
How long does Grammarly keep what we put into Grammarly?
On Free and Pro (personal account): No period is published; the policy states a purpose test and says it varies by data type and settings.
Grammarly's own words: "We retain personal data for as long as necessary to provide our products to you" (read 2026-11-02). On Business and Enterprise: Not found in the pages we read.
Can an administrator read what our staff typed into Grammarly?
An admin adds, removes and transfers accounts and sets roles and permissions. Grammarly's own words: "Administration tools make it easy to add, remove, or transfer accounts and to manage team member roles, permissions, and access within your company." (read 2026-11-02).
Will Grammarly sign a Business Associate Agreement for Grammarly?
Grammarly says it will sign one on request, and does not say which plans qualify. Grammarly's own words: "If you need to sign a BAA in order to comply with HIPAA, please submit your request here." (read 2026-11-02).
A signed BAA is between your practice and Grammarly; we do not sign it for you, and we do not read a compliance badge as one.
How do we find out which version of Grammarly our staff are using?
Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.
Sources
Grammarly’s own pages, with the date each was read. Nothing on this page comes from anywhere else.
- grammarly.com/privacy-policy, read
- grammarly.com/security, read
- grammarly.com/compliance, read
All 15 tools, side by side, or run the AI tool risk checker over the ones you know about.
Other tools people ask about
Same question, different answers. The ones in the same category are the ones staff swap between.
Is Notion AI safe for client data?
Workspace assistant · Notion
Is ChatGPT safe for client data?
General assistant · OpenAI
Is Microsoft Copilot safe for client data?
General assistant · Microsoft