Security & privacy
How we handle your documents and data. We are honest about what we do and don't do.
Data storage
- Original documents are stored in Cloudflare R2, private by default. We never make business documents publicly accessible.
- RFQ data, catalogs and line items live in PostgreSQL (Neon), scoped to your organization.
- No binary documents are stored in database rows.
Access control
- Every server route verifies the caller's organization. A user of company A cannot see company B's data.
- Organization IDs are never trusted from the client without validation.
- File downloads require authentication and organization ownership.
AI & external providers
- Extraction and matching are deterministic — no AI provider is called by default.
- No document is sent to an external AI provider unless explicitly configured.
- Stripe, Resend, R2 and Clerk are optional integrations, configured via environment variables.
What we do not claim
- We do not claim GDPR compliance, SOC 2 certification, or any other certification without evidence.
- Privacy Policy and Terms of Service are drafts pending legal review.
Subprocessors
If enabled: Clerk (auth), Neon (database), Cloudflare R2 (storage), Stripe (payments), Resend (email). Each has its own privacy and security terms.