Confidential by construction.

What we collect

We collect the information you provide to run a search: account details, organization and committee information, the RFP you draft, the firms you invite, and the responses firms submit. We also keep operational logs needed to run and secure the service, and we measure page views with cookieless, anonymous analytics that do not track you across sites.

How it is protected

• Draft searches never leave your organization — there is no path that shows a draft to anyone outside it.
• Responses stay sealed until your response deadline, measured against our server clock, not your browser.
• An organization's identity, when withheld, is excluded from what firms can see.
• Contact information is never shared with invited participants beyond what the RFP itself discloses. Firms see only the contact details your organization chose to include, and your committee sees only what a firm put in its response.
• Access to every confidential record is enforced in the data layer, and unauthorized access returns a plain 404.

Services we rely on

We use a small set of infrastructure providers to host the application, store data, send transactional email, and generate draft language: Vercel (hosting and file storage), Neon (database and authentication), Resend (transactional email), and OpenAI (draft generation). These providers process data on our behalf under their own security commitments.

Your rights

Organizations and firms can request an export or deletion of their data. Some records tied to a completed decision or a fiduciary audit trail are retained where a decision was made in reliance on them; those exclusions are documented. See Data & privacy for how aggregation is governed.