Security and privacy

Procurement documents are sensitive. They contain pricing, strategy, technical details, and sometimes personal data. Here's how we handle them.

Data storage

Documents are stored in Amazon S3 (AWS cloud storage) with encryption at rest. Access is restricted to your organization's account - other users can't see your files.

Analysis results, findings, scores, and metadata are stored in a PostgreSQL database, also encrypted at rest.

All connections between your browser and our servers use HTTPS (TLS encryption in transit).

Who can access your data

• Your organization members - everyone in your organization sees all procurements, documents, and results
• Platform administrators - for troubleshooting and support purposes only
• No one else - your data is not shared with other customers, and not used to train AI models

AI processing

When you run an analysis or composition, your documents go through two layers of isolation before they reach an AI model:

Per-run sandbox

Each AI run (bid analysis, RFP composition, RFP review, prep checklist, market research, etc.) runs inside a fresh, throwaway workspace called a sandbox — essentially a dedicated container created specifically for that one run. Your documents are uploaded into that sandbox at the start of the run, and only the agent driving that run can read them.

• Different runs (and different organizations) get different sandboxes — one run never sees another run's files.
• When the run finishes, the sandbox is destroyed. No state lingers.
• If a run pauses for clarification, the sandbox is preserved exactly as the agent left it (so you can resume later) but stays just as isolated.

AI provider boundary

The agent inside the sandbox calls AI services (language models) when it needs to reason or generate text. Here's what that means:

• Document text is sent to the AI provider in the conversation as the agent reads files and works.
• The AI provider doesn't store your data for training purposes. We use API access with data processing agreements that prohibit training on customer data.
• Processing uses APIs — text is sent for processing and a response is returned. This does not itself imply zero retention for every service.

The AI providers we use (Anthropic, OpenAI, Google) all offer enterprise API terms with clear commitments about not using API data for model training.

Document parsing and the Library

Workspace tools extract text and tables from PDF, Word and Excel files. Scanned pages and images can be read by an AI image model; this is not exclusively a local OCR process.

Documents added to the Library also have a persistent content-search index:

• Extracted text, OCR checkpoints, passages, location references, coverage and numerical content representations (embeddings) are stored in the database, scoped to your organization.
• Library passages and search queries are sent to OpenAI for embeddings using platform credentials, even when you bring your own API key (BYOK) for agents.
• Library scanned-page/image reading uses the platform's AI provider. Subsequent agent judgment can use your configured provider.
• This indexing applies only to Library entries, not every procurement document. The extraction workspace is deleted after its attempt; stored Library passages remain for repeat searches.
• Searches check organization and current source identity. Partial reading, OCR errors and document validity still require checking the original.

This describes data routing; the particular AI service's retention terms depend on the applicable service terms and configuration.

Authentication and access

• Email and password authentication
• Sign in with Google - available on the registration and login pages as an alternative to a password
• Rate-limited sign-in - repeated failed sign-in attempts are throttled, both from a single source and against a single account, to protect accounts from password guessing
• Organization-based access - you see everything in your organization, nothing from others
• No public access - all data requires authentication

Audit log

Owners and Admins can see who did what in the organization, and when, under Account settings → Audit log. Each entry shows the time, the user, the action, the object it affected, details, and the IP address. Entries can't be changed or deleted.

The log covers these categories:

• Sign-in - sign-ins, sign-outs, failed sign-ins, and password changes
• Members - invitations, added and removed members, and role changes
• Documents - uploads, deletions, and file downloads
• Library - documents added, archived, or deleted
• Procurements and bids - procurements and bids created or deleted
• Tender selection - tenders shortlisted or dismissed, with the dismiss reason, and undone decisions
• AI agents - AI runs started or resumed, including tender recalculations and eligibility checks, and questions asked to the AI assistant
• Edits - records created, edited, or deleted, such as lots, evaluation criteria, items, and requirements
• Exports - Excel, Word, and ZIP downloads
• Settings - changes to tender selection and scoring settings, tender services and the company profile, model providers, planning, and billing details
• Security - attempts to do something your role doesn't allow, and audit log exports

For edits, the log records which fields changed, never their values.

Filter the list by user, category, and date range; it shows 50 entries per page. Export CSV downloads the filtered entries, and each export is itself recorded in the log.

Data deletion

When you delete a procurement, all associated data is removed:

• Uploaded documents are deleted from storage
• Analysis results, findings, and scores are deleted from the database
• This is permanent and cannot be undone

Archiving a Library document immediately excludes it and its children from search; its index may remain for history and restoration. Replacing the source file immediately excludes old passages, and a background job removes obsolete indexes. Hard-deleting a Library entry removes its passages and indexes. Existing usage can require archiving instead of deletion. An entry saved from a procurement references its source Document rather than creating an independent original-file backup.

When you delete your account, all your data is removed.

What we don't do

• We don't sell your data
• We don't use your documents to train AI models
• We don't share your data with third parties (except the processing services described above)
• We don't access your documents unless you explicitly ask for support help