Security

All traffic to DraftBid AI uses HTTPS, and browsers are told to use HTTPS only (HSTS). Our database and file storage providers encrypt stored data at rest.

Every request is checked on our server against the signed-in account; IDs sent from the browser are never trusted on their own. Requests for another account's RFPs, drafts, library items or files get a "not found" response. Automated tests check this for each data endpoint.

• Files are stored in private storage. Opening a file creates a link that only works for 60 seconds, and only for the account that owns it.
• File type is checked by content, not just by the file name. Only PDF, Word, Excel (.xlsx), CSV and image (PNG, JPEG) files are accepted, up to 25 MB, and macro-enabled Office files are refused.
• We only read text from files. Macros and embedded content are never run.

Document text is sent to our AI provider through its business API to extract requirements and draft text. We do not train models on your data.

The provider in use is listed on the subprocessors page. Text from uploaded documents is treated as data, never as instructions to the AI.

Access to production systems is limited to named staff who need it to run the service. The internal admin area is restricted to verified staff email addresses and is hidden from everyone else.

Error reports include the page, the technical error and your account ID. Request bodies, cookies and the content of your files, library and drafts are removed before a report is sent. We record AI usage (model, token counts, cost) without any document content.

You can delete an RFP, with its file, extracted text and drafts, at any time, and you can delete your whole workspace from Settings. Deleted data is removed from our live systems straight away.

Database backups are held by our database provider for its restore window and then overwritten.

We do not currently hold SOC 2 or ISO 27001 certification. If your buyer requires them, tell us what you need and we will answer your security questionnaire honestly.

Email privacy@draftbidai.com with the details and steps to reproduce. Please do not access other customers' data or disrupt the service while testing. We will acknowledge your report and keep you updated while we fix it.