Security & data
Proposals hold things you don't want loose: pricing, past performance, people's names. This page says exactly how we protect them, what leaves our server, and what we don't have yet. Nothing here is a certification or a guarantee.
What we don't have yet
- No security certifications. We are not SOC 2 audited, FedRAMP authorized, or CMMC certified.
- Don't put CUI or classified information in the apps. Controlled Unclassified Information and classified material need systems authorized for them, and this isn't one.
- No self-service account deletion yet. Ask through the contact form and we will delete your account and your company's records. Encrypted backup copies expire on their own schedule (daily copies after 30 days, monthly copies after 12 months).
- No encryption of the stored database files beyond the server's own disk. Passwords are never stored (only a one-way hash; see below).
Your company's records are kept apart
- Each company's private records (profile, credentials, past performance, pipeline, drafts, settings) are kept in a separate database file for that company, not in a shared table with everyone else.
- The three apps are not reachable from the internet. They only answer the website, and only when each request carries a signature proving which signed-in company it's for. Unsigned requests are refused.
- Teammates only see a company's records after the account owner sends them a private, single-use invite link and they accept it. The owner can remove anyone, and anyone can leave.
Your account
- Your own AI key (optional). If you add your own Google Gemini key for extra AI drafts, we check it with Google, store it encrypted (AES-256-GCM), show only its last 4 characters, send it only to the drafting app for your own drafts, and delete it the moment you remove it. Drafts made with it are billed to your Google account.
- Passwords must be at least 10 characters and are stored only as a slow one-way hash (scrypt), never as the password itself.
- You stay signed in with a cookie the browser won't show to scripts (HttpOnly), sent only over HTTPS, for up to 14 days.
- Changing your password, or choosing "Sign out everywhere," ends every other session at once.
- Sign-in, sign-up, and other sensitive actions are rate-limited to slow down password guessing.
- If you enter your own SAM.gov API key, the apps show only its last four characters back to you.
In transit and on the page
- Every page and app request uses HTTPS. Browsers are told to always use HTTPS for this site (HSTS).
- Pages run only our own scripts (a strict Content Security Policy), which blocks most injected-script attacks.
- No advertising trackers, no third-party analytics, no tracking cookies.
What leaves our server
- AI drafting (optional): when you ask for an AI-written draft or use the assistant, the text for that one request (the notice's requirements and the verified records you chose) goes to Google's Gemini API to produce the answer. Evidence-only drafts never leave our server. Google's handling is governed by the Gemini API terms. Backup: only if we switch it on, an AI draft or proposal writing request may go to NVIDIA's hosted AI service instead, when Gemini is unavailable. We allow only US-developed models there. A request made with your own Gemini key always stays with Google and is never sent to the backup.
- Payments: card and bank details go straight to Stripe. We receive only your plan, its status, and the renewal date.
- Public government APIs (SAM.gov, USAspending.gov, GSA, Grants.gov) are asked for public data. Your private records are not sent to them.
- Your own integrations: if you set up a digest email, webhook, or feed link, the notices it covers go where you point it. Webhooks must use HTTPS and a public address.
Who can see your data
You, and the teammates you invite. The operator of this service (Jackson Lopez Holdings LLC) has administrator access to the server, as any host does, and looks at customer records only to fix a problem you report or when the law requires it.
How the server is run
- Nightly encrypted backups, off the server. Every night the databases are copied, checked for damage, and encrypted before they leave the server, with a key that is not stored on the server. The encrypted file goes to Google Cloud Storage. Daily copies are kept 30 days and monthly copies 12 months. The server can add backups but cannot delete them.
- The website and the apps run as separate, unprivileged system users with restricted permissions, behind a firewall that allows only web traffic and administrator SSH.
- Secret keys are stored in files only those services can read, never in the code.
Found a security problem?
Tell us through the contact form with "Security" in the message. We'll reply, fix what's real, and credit you if you'd like.