Security
How RFP.co handles customer data: tenant isolation, encryption, access control, retention, subprocessors and how to report a vulnerability.
Solicitation documents and draft proposals are commercially sensitive: they carry your pricing, your staffing and your judgement about a competitor. This page describes what RFP.co actually does with them — and, below, what it does not do yet.
Everything here is a mechanism in the running software rather than an aspiration. The binding version of anything contractual is in the terms, the privacy policy and the Data Processing Addendum.
How the platform is built
Tenant isolation is structural, not a convention
Isolation is enforced at the query layer rather than left to each route to remember. A scoped database client cannot express an unscoped query, so a developer who forgets a filter gets no rows instead of another customer’s rows. Every model in the schema is explicitly classified by tenancy mode, and the test suite fails if a new one is added without a classification.
Passwords are hashed with Argon2id
Argon2id, memory-hard and tuned so that GPU parallelism buys an attacker much less than it would against bcrypt or PBKDF2. Stored hashes carry their own parameters, so the cost can be raised later and existing credentials are rehashed on next sign-in rather than left at the old setting.
Session tokens are never stored
What the database holds is an HMAC-SHA256 fingerprint of each session, verification link, password reset and invitation — keyed by a server-side secret. A copy of the database, on its own, yields nothing that can be replayed as a session. Rotating that secret invalidates every outstanding token at once, which is what rotating a secret ought to mean.
Federated sign-in uses PKCE
Google sign-in is an authorization code flow with PKCE, the verifier held server-side and only its SHA-256 challenge sent to the provider. An intercepted authorization code is not sufficient to complete an exchange.
Authentication is rate limited
Sign-in, registration and password reset are rate limited against a shared store rather than per process, so limits hold across replicas rather than multiplying by the number of them.
Submission records cannot be rewritten
What you submitted, and when, is immutable — enforced by database triggers, not by application code that a future change could route around. A produced export may expire, but the record of it is append-only. A requirement that turns out not to apply is marked as such; nothing in the compliance history is deleted.
Documents are private by default
Uploaded solicitations and generated proposals live in object storage with no public access path. Every download is authorized per request against the requesting workspace. Share links carry their own tokens, may be password protected, and revocation is re-read on each request rather than cached.
Data is processed in the European Union
The platform runs in Falkenstein, Germany, and document storage is pinned to an EU jurisdiction at the storage layer — a contractual guarantee from the provider rather than a best-effort region preference. Traffic is served over TLS, and objects are encrypted at rest by the storage provider.
Reading is a privileged act in the knowledge library
Everywhere else in the platform the dangerous verb is a write. In the library it is a read, because that is where a workspace keeps its pricing floors, its unredacted subcontract terms and the questionnaire naming which controls are compensating rather than implemented. Sensitivity is a four-rung ladder, and the top rung is opened by no role at all — only by a grant that names one person.
A delivered proposal can be taken back
A share link is a hashed token, shown once and unrecoverable afterwards. It may carry an Argon2 password, an expiry and a watermark burned into the render, and revocation is re-read on every request rather than cached — so withdrawing a proposal takes effect on the next click rather than the next cache expiry. Failed password attempts are throttled and lock the link. Every opening is recorded, and deliberately records nothing identifying beyond what the share already named: the address is truncated to a /24 and the browser to its family, which distinguishes two devices without building a tracking record of a contracting officer.
A correction is a lock, not a suggestion
When somebody rewrites an extracted requirement, that field is locked. A later pass over an amendment records what it read and does not overwrite the correction. Nothing extracted is deleted: a requirement that turns out not to apply is marked as such, and what the extractor originally said survives being disagreed with.
A workspace can bring its own model key
A workspace may supply its own AI provider key, sealed with AES-256-GCM under a key held in the environment. The plaintext leaves the database only inside a worker about to make a call with it, nothing in the interface renders it, and the screens show four characters. Every AI run records which key paid for it. A key that stops authenticating fails visibly and falls back to the platform key rather than silently stopping the work.
Nothing retrains itself
No part of this platform reads a feedback event, a metric or a recommendation and changes a model weight, a prompt, a qualification gate or a threshold. The learning loop stops at a table and a person decides — enforced by a database check constraint rather than by good intentions, because a weight changed overnight reorders every match in every workspace and the customer who signs in to a different list the next morning has no way to get the old one back.
What we do not have yet
A security page that lists only strengths is one a reviewer stops trusting the moment they find the first gap themselves. These are the ones asked about most often.
We do not hold a SOC 2 Type II report
We hold no SOC 2 report and no ISO 27001 certificate, and we would rather say so here than have you find out in week three of an evaluation. Much of the underlying evidence exists — the tenancy proofs, the append-only guards, the audit ledger — but evidence is not an attestation, and an attestation requires an auditor and a period of observation that cannot be compressed. If a report is a hard requirement for you, tell us during the evaluation rather than after it.
Single sign-on and SCIM are not built
There is no SAML or OIDC single sign-on and no SCIM provisioning. Accounts are managed in the application, and de-provisioning is a person removing a member. For a workspace of a few dozen people that is workable; for one of several hundred, it is the honest reason to wait.
There is no United States processing region
The platform processes in the European Union, and that is currently the only option. It is a strong position for a European buyer and it is the wrong one for a US contractor whose contract data may not leave the country — which is a large part of who this product is for. We would rather name that plainly than let it surface at the end of a procurement.
Encryption keys for data at rest are ours, not yours
Data at rest is encrypted by the storage provider under keys we manage. Customer-managed keys are not offered. The key a workspace can bring is its AI provider key, which is a different mechanism solving a different problem, and the two should not be read as the same answer.
No independent penetration test has been commissioned
Security work here has been architectural and adversarial in review rather than tested by a third party under contract. We have not commissioned a penetration test, and there is no report to share.
Reporting a vulnerability
Write to security@rfp.co. Include what you did, what happened and what you expected. Research conducted in good faith — without exfiltrating data belonging to other customers, degrading the service, or accessing an account that is not yours — is welcome, and we will not pursue legal action over it.
There is no paid bounty programme. We will acknowledge your report, tell you what we found, and credit you when a fix ships if you would like to be named.
Who else sees your data
Every third party that processes customer data is named in the subprocessor list, along with what it receives and where it processes. We give 30 days’ notice before adding one, and a customer who objects on reasonable data protection grounds may terminate the affected service for a refund.
See what you are not bidding on.
Connect a source, describe what your company does, and look at the opportunities that come back before deciding whether any of this is worth your time.