Company isolation
Public federal data (SAM.gov notices, USAspending awards, installation records, published .mil leadership pages) is shared by every customer. Everything a company adds or decides is private: users, search profiles, keywords, relevance decisions, archives, uploaded documents, proposals, notes, AI spend and settings.
Isolation is enforced in the database session, not left to each page. Every query against a company-owned table is filtered to the signed-in company; a query without that filter is refused by the application, not merely unfiltered. A route-enumerating test suite signs in as a second company and asserts that every URL taking an id answers 404 for another company's records.
Credentials and secrets
- Passwords are stored as bcrypt hashes. Password-reset links are single-use, expire after an hour, and only their SHA-256 is stored.
- Your SAM.gov API key is encrypted at rest (AES-128-CBC with HMAC, keyed from a server secret), never logged, and shown only by its last four characters.
- Platform secrets come only from environment variables. Third-party request logs are filtered so an API key in a URL is never written.
- Sessions are signed cookies; every form carries a CSRF token.
AI
- Models are called through the Anthropic API. Under Anthropic's commercial terms your inputs and outputs are not used to train their models.
- AI is used for classification and summaries only. It never sends anything: the system transmits no outreach to any federal contact, and approving a draft only marks it ready for a person to send.
- Every generated text is scanned against a prohibited-claims list; anything unsupported is marked EVIDENCE REQUIRED and anything unconfirmed UNVERIFIED.
- Every AI call is metered and shown to you with its cost.
Hosting and transport
- Application and managed PostgreSQL on Railway; TLS on every connection with certificates from Let's Encrypt.
- Uploaded documents are stored under generated names on an encrypted volume; an uploaded filename never reaches the filesystem.
- Platform administrators can act as a company only through an explicit switch, and every such action is written to an audit log you can request.
What we do not have yet
We hold no FedRAMP authorisation or equivalency, no CMMC assessment and no SOC 2 report. GovCapture AI is not a system for storing CUI or ITAR-controlled material, and our terms ask you not to upload it. If your procurement requires any of these, tell us; it shapes the roadmap.
Reporting a vulnerability
Write to security@govcaptureai.com. We acknowledge within two business days and do not pursue researchers who report in good faith.