Productivity & Writing
Grammarly
Medium riskWriting assistant delivered mainly as a browser extension and keyboard, offering grammar correction and generative rewriting across nearly everything a user types, with free, Pro, Enterprise, and Education tiers.
Is Grammarly safe for confidential data?
Grammarly presents two different risks to a school, and neither is the obvious one. First, academic integrity: Grammarly now includes generative AI, and its output can trip AI detectors — the widely covered case of Marley Stevens, a University of North Georgia student put on academic probation in 2023-24 after Turnitin flagged a paper she says was only polished with Grammarly (a tool her university promoted), shows institutions punishing students for using software the institution itself distributes, without a policy saying where assistance ends and misconduct begins. Second, data: the extension reads what is typed into the pages where it runs — for staff, that can include emails and notes about identifiable students. Grammarly's posture here is decent and tier-dependent: it states user content is not sold and is not used to train models, but free and individual accounts have a product-improvement setting that is on by default, while Enterprise and Education accounts have it off by default with SOC 2 and DPA coverage.
Risk by plan
The same product often carries very different terms depending on the tier — consumer plans are where the exposure concentrates.
No model training on content per policy, but the product-improvement setting is on by default and the individual, not the school, controls it — the tier most staff and students actually use.
Product improvement off by default, admin controls, SOC 2 reporting, and a DPA.
Product improvement off by default for all Education accounts; the tier a school should be on if it recommends Grammarly at all.
Data handling
Training on inputs
Grammarly states it does not use customer content to train its AI models; separately, a Product Improvement and Training setting (on by default for Free, Premium, and self-serve Pro; off by default for Enterprise, sales-sold plans, and all Education accounts) governs use of content to improve the product. Individuals can opt out in settings.
Retention
Account content and processing data retained under Grammarly's privacy policy; enterprise agreements add contractual deletion terms. Text processed by the extension transits Grammarly's cloud wherever the extension is active.
Residency
U.S.-based processing by default; enterprise plans document sub-processors in the Trust Center. Canadian institutions using staff-wide deployments should treat student-related text reaching Grammarly as a disclosure to assess under PIPEDA or provincial public-sector law, not as a browser convenience.
Compliance
- SOC 2Yes
- GDPR / DPAYes
- HIPAA BAAConditional
Certifications typically apply to specific tiers and contracts — confirm scope in writing before relying on them.
New to these frameworks? See our plain-language guides to SOC 2 and the other AI compliance standards.
Enterprise controls
- SSO / SAML and admin console
- Product-improvement training off by default
- DPA and Trust Center documentation
- Feature controls (e.g., restricting generative AI)
Frequently asked questions
Does Grammarly count as AI cheating?
It depends entirely on the institution's policy and which Grammarly features were used — spelling and grammar fixes are accepted almost everywhere, while its generative rewriting and drafting features may fall under AI-use rules. The real problem is that many institutions recommend Grammarly while running AI detectors that can flag its output, leaving students in a gap the policy never addressed. Students should ask instructors which features are permitted; institutions should write it down.
Can Grammarly get flagged by Turnitin?
It has happened. The best-known case is Marley Stevens, placed on academic probation at the University of North Georgia after Turnitin flagged a 2023 paper she says was written by her and polished with Grammarly — a tool promoted by her university — costing her a scholarship-qualifying grade. Detector vendors dispute how often pure grammar correction triggers flags, but generative rewriting plainly can, and students should keep drafts and version history as protection.
What does the Grammarly extension see when staff use it?
Whatever is typed on pages where it is active — which for teachers and counselors can include emails to parents, report-card comments, and notes about identifiable students, all processed through Grammarly's cloud. On a free personal account that flows through default-on product-improvement settings the school does not control; this is shadow-AI adoption in its quietest form. Schools that want Grammarly should deploy the Education or Enterprise tier with training off and admin control, and say explicitly which accounts staff may use for student-related writing.
Policy changelog
- Initial entry published from Grammarly's published trust documentation and cited coverage.
Sources
- Grammarly Trust Center
- Grammarly product improvement and training control
- EdSurge on the Marley Stevens case
This profile summarizes the vendor's published policies as of the verification date. It is not legal advice.
Grammarly is probably already in your organization.
Sanitized AI shows you who is using it and redacts sensitive data from prompts before it leaves your control.
More AI tool profiles
AI content platform for marketing teams: campaign copy, brand-voice generation, and marketing workflows on top of third-party LLMs.
AI writing, Q&A, and search embedded in Notion workspaces, with access to the pages and databases the user can see.
Enterprise ambient clinical documentation platform, deeply integrated with Epic, that records clinician-patient conversations and generates structured notes.
Adobe's generative image and design models, standalone and embedded across Creative Cloud, trained on licensed content such as Adobe Stock and public-domain content.