How we protect your work.

Controls in place

• Encryption at rest and in transit

  Live

  Tenant documents are stored in Cloudflare R2 with AES-256 server-side encryption. PostgreSQL data (capability profiles, projects, proposals, audit logs) is encrypted at rest by Supabase. All network traffic uses TLS 1.2 or higher.

  Per-tenant API credentials (SAM.gov keys, BidNet sessions, etc.) get an additional AES-256-GCM envelope encryption layer using a platform master key held in Vercel's encrypted environment. Decryption happens only at ingestion time, never in cross-tenant code paths.

• Tenant isolation enforced at the database layer

  Live

  Every tenant-scoped table uses Postgres Row-Level Security with FORCE RLS enabled. Application code sets the current tenant via app.current_tenant_id before any query — a coding mistake that forgot the tenant context would return zero rows, not another tenant's data.

  AI retrieval (vector searches across past proposals and reference docs) inherits the same RLS scoping. There is no code path that joins or searches across tenants at runtime.

• Multi-factor authentication + step-up for sensitive operations

  Live

  Authentication runs through Clerk. MFA is available on every account; tenants can require it for their org. Platform-operator (super-admin) actions — suspending a tenant, triggering a password reset, minting a trial code — require fresh reauthentication via Clerk's step-up flow.

• Audit logging on every privileged access

  Live

  Document access, AI inference operations, capture lifecycle changes, source-credential reads, admin actions, and authentication events all write to an append-only audit log. Tenants can view + export their own audit history from Settings → Audit log.

  Retention: 3 years. Required for OMB Uniform Guidance (2 CFR 200) compliance for federal grant-receiving tenants and supports SOC 2 evidence collection.

• Super-admin allowlist with no Clerk-role escape hatch

  Live

  Cross-tenant platform operator access lives in a dedicated super_admins table that only the BYPASSRLS database connection can read. Membership isn't a Clerk role (which could be granted from the dashboard with the wrong blast radius) — it's a deliberate database write, audited.

• Personal Data Breach notification within 72 hours

  Live

  Per DPA Section 8, we notify affected customers without undue delay and within 72 hours of becoming aware of any breach affecting their data, including nature, scope, likely consequences, and remediation status.

• Restricted content categories

  Live

  Today's Terms of Service prohibit uploading classified or controlled unclassified information (CUI), regulated health data (PHI) without an executed BAA, and ITAR / EAR-controlled technical data. Tenants in those verticals contact us before uploading; we either sign the required addendum or recommend keeping that material in a different system.

• SOC 2 Type 1 preparation

  In progress

  We're in evidence-collection mode for SOC 2 Type 1 — using one of the automated SOC 2 platforms to map our controls (access management, change management, encryption, vulnerability monitoring) against the Trust Service Criteria. Audit engagement begins after we sign our second paying tenant.

• Third-party penetration test

  Planned

  Scheduled for the second half of the year alongside SOC 2 Type 1. Report summary will be available under NDA to qualified prospects.