Security
How we protect your company, bid, and opportunity data.
Data at rest
Customer data is stored in a managed Postgres database (Supabase, AWS us-east-1) that is encrypted at rest with AES-256, as are its backups and uploaded files. The database service key is used only by server code and is never sent to your browser.
Data in transit
Every connection uses TLS, from your browser to the app, from the app to the database, and from our servers to SAM.gov, Grants.gov and USASpending. The site only serves HTTPS and sends a Strict-Transport-Security header, so browsers refuse plain HTTP.
Tenant isolation
Tables that store customer data have Postgres row-level security policies that limit every read and write to your own company. Signed-in pages and features run as you, so the database itself enforces that boundary. Server-only jobs, such as loading SAM.gov notices and sending digests, use a service key, and the public API limits every query to the company the API key belongs to.
One company cannot read another company's bids, contracts, past performance, proposals, documents or Bid Assist conversations.
Sign in
Accounts use Supabase Auth with email and password or Google sign-in. Passwords are hashed with bcrypt and never stored in plain text. Sessions are refreshed automatically and end when you sign out.
API keys are random tokens stored only as SHA-256 hashes. We show a key once when you create it, and you can revoke it at any time in Settings.
Certifications
ContractsIntel does not hold a SOC 2 report or FedRAMP authorization today. If your company needs a security questionnaire completed before buying, email support@contractsintel.com.
Reporting a vulnerability
If you find a security problem, email support@contractsintel.com with the details. We reply within one business day and will not take action against good-faith research.
If something goes wrong
If we confirm that your data was accessed without permission, we will tell you by email within 72 hours, with what happened and what we are doing about it.
Data handling for federal work
ContractsIntel helps small contractors find and pursue federal work, but it is not approved for Controlled Unclassified Information, ITAR data or classified material. Do not upload documents marked CUI, export controlled technical data or anything classified.