Data & privacy
What we aggregate, and what we never touch.
RFPFree holds confidential search intentions for institutions with a fiduciary duty. Here is exactly how that information is handled, in plain language.
Confidential by construction
Draft searches never leave your organization. While a search is a draft, there is no path — no page, no link, no export — that shows it to anyone outside your organization.
Responses stay sealed until your deadline. Your committee cannot read any submission until the response deadline passes, and that is measured against our server clock, not a value your browser could change.
Uploaded intake documents are never shown to firms. The materials you share to shape the RFP are for drafting only. They are not exposed to responders under any circumstance.
What is aggregated — and the floor that protects it
Over time, normalized figures such as fee structures may feed de-identified, aggregate benchmarks — the kind of market context that helps everyone price and evaluate more fairly. Aggregation is governed by a hard rule: no benchmark is ever published unless it draws on enough independent submissions that no single firm or organization can be identified from it, and no cut is shown where one firm dominates the sample. Below that floor, nothing is published at all.
What is never aggregated
- The identity of an organization that has withheld it
- Any individual submission, attributable to its firm
- The contents of a search that has not been sent out
- Anything from an organization or firm that has opted a submission out
Your data, on request
Organizations and firms can request an export or deletion of their data. Some records tied to a completed transaction or a fiduciary audit trail are retained where a decision has already been made in reliance on them; those exclusions are documented. A full privacy policy and a list of the services we rely on will be published before public launch.
RFPFree is a private tool, not a public procurement system. Some hospital systems and public universities have statutory notice, confidentiality, or open-records obligations. We do not claim compliance with them. Organizations subject to formal procurement rules should confirm their approach with counsel.