Confidential by construction.

What we collect

We collect the information you provide to run a search: account details, organization and committee information, the RFP you draft, the firms you invite, and the responses firms submit. We also keep operational logs needed to run and secure the service, and we measure page views with cookieless, anonymous analytics that do not track you across sites. On the public marketing pages and at account creation we also use Google Ads conversion measurement, which sets Google's _gcl_au and _gcl_aw cookies to tell us whether a visit came from one of our ads. It is not loaded on preview or local environments, and it does not read the contents of any search.

How it is protected

• Draft searches never leave your organization. No path shows a draft to anyone outside it.
• Responses stay sealed until your response deadline, measured against our server clock, not your browser.
• An organization's identity, when withheld, is excluded from what firms can see.
• Contact information is never shared with invited participants beyond what the RFP itself discloses. Firms see only the contact details your organization chose to include, and your committee sees only what a firm put in its response.
• Access to every confidential record is enforced in the data layer, and unauthorized access returns a plain 404.

Services we rely on

We use a small set of infrastructure providers to host the application, store data, send transactional email, and generate draft language: Vercel (hosting and file storage), Neon (database and authentication), Resend (transactional email), OpenAI (draft generation), and Google Ads (advertising conversion measurement only). These providers process data on our behalf under their own security commitments.

Your rights

Organizations and firms can request an export or deletion of their data. Some records tied to a completed decision or a fiduciary audit trail are retained where a decision was made in reliance on them; those exclusions are documented. See Data & privacy for how aggregation is governed.