Grammarly Enterprise Risk Assessment | AI Tool Risk

Back to AI Tools

Grammarly

Risk Overview

Moderate Risk

4.9

/10

Writing Assistant

Text Editing

Top Risks

Browser extension reads ALL text typed across every website (extremely broad data collection); 2018 high-severity token exposure vulnerability affected 22M users; default opt-in to AI training on all typed content; mandatory arbitration with class action waiver; company rebrand to Superhuman Platform may obscure policy changes; enterprise training opt-out historically required 500+ user accounts.

Mitigations

SOC 2 Type II + ISO 27001/27017/27018 certifications (strongest security posture in this batch); opt-out for AI training available via settings; does not sell user data to advertisers; bug bounty program active; 72-hour security incident response demonstrated in 2018; GDPR compliance for EU; arbitration opt-out available within 30 days; enterprise Data Processing Agreement available.

Get started

Is your team using

Grammarly

safely?

Book a Demo Free Assessment

Highest Risk Categories

The highest-scoring risk categories identified in this assessment.

Legal Terms

Terms of Service (effective October 29, 2025, under Superhuman Platform Inc.) include mandatory arbitration by a single arbitrator. Opt-out available by emailing arbitration-opt-out@grammarly.com within 30 days of agreeing to terms. Small claims court option preserved. Arbitration confidential. Class action waiver applies. San Francisco County, California governing law. Liability caps standard. Arbitration terms are aggressive but opt-out mechanism exists.

/10

Training Use

Grammarly uses user content to train AI models by default. Opt-out available for individual users via Product Improvement and Training Control setting. However, opting out of AI training for enterprise features historically required a business account with 500+ users. Browser extension captures ALL text typed across any website. Company name changed to Superhuman Platform Inc. (October 2025) which may affect policy continuity perception. Opt-out exists but requires active user action.

/10

Data Retention

Data retained for service provision. Account deletion rights available. Specific post-deletion retention periods not prominently disclosed. Browser extension data (typed text) processed in real-time and transmitted to servers. SOC 2 and ISO certifications indicate data lifecycle controls exist. Users can access and delete account data. Reasonable retention practices suggested by certification posture.

/10