What happens to your data, in enough detail to check

Where your data lives

Your account, your team's pursuits, notes, tasks, checklists and company profile are rows in a Postgres database at Supabase, in its East US region in the United States. Files you upload to a pursuit are objects in Supabase storage, in the same region. The application runs on Railway, in its US East region. Data is encrypted in transit on every connection, and the website and console send a strict transport header so a browser never falls back to plain HTTP. At rest it is encrypted by the database and storage provider.

Solicitation documents are public material published by government agencies on SAM.gov and the other public sources we read. The text we extract from them is kept as a shared cache, not as your data, and is not linked to your account.

One team cannot see another

Every record that belongs to a team carries the team's id, and every read and write of one is scoped to it in the query itself. The team is never taken from the request: the API derives it from the signed-in session on every call, so there is no id a caller could change to reach somebody else's work. Neither the browser nor the mobile app reads or writes the database directly, with one exception: the account page reads the signed-in person's own subscription row. The client keys cannot read or write any team table.

• Uploaded files are reached only through short-lived signed links the API issues, under a path that begins with the team's id.
• Public data (notices from SAM.gov, Grants.gov and the other public sources we read, forecasts, USAspending awards, contract vehicles, CALC+ rates) is the only thing readable by id alone, and it is public.
• The 8 October 2026 review followed every id-parameter route into its SQL and found no team table reachable by id alone. Its two housekeeping findings were closed the same week.

Accounts and sessions

Sign-in is handled by Supabase Auth. Passwords are hashed by that provider and never pass through our code or our logs. A new password needs at least eight characters with upper and lower case, a number and a symbol, and a new address must be confirmed by email before it can sign in. Every signed-in call to the API carries a session token in a request header. The calendar feed works differently: a calendar app reads your team's deadlines through a secret address, which you can replace or turn off. The console's own cookies are bound to its host and shared with no other site, and signing in on the console signs you in nowhere else.

Two-factor authentication can be turned on from the account page on the website: a six digit code from an authenticator app at every sign-in. It is not only a screen. The API refuses a session that has not given its code, so a password alone reaches nothing.

A Premier team can sign in through its company's own identity provider instead: Okta, Microsoft Entra or Google Workspace, over SAML. We set it up with the company's IT team, and the owner can then require it for everybody on the team but themselves, so a broken identity provider can never lock the team out. Somebody who joins that way becomes a member of the team, within its seats.

Sign-ins, password changes and email changes are logged by the authentication provider. Sign-up, sign-in, password reset and confirmation emails are rate limited by the authentication provider.

Roles

Every team has one owner, at most one admin, and everybody else is a member. A Premier team holds up to 5 people, and a larger team can write to us for a quote; Essential, Professional and Free are for one. The daily work (reading, saving, pursuing, asking, drafting) is open to everybody on the team. The things that define the team or destroy shared work need an owner or an admin: the company profile, UEI and CAGE, certifications, past performance, inviting and removing people, setting how many reviews each person gets, API keys and webhooks, and removing a pursuit. A thing with a maker (a file, an alert, a scheduled report) can be changed by its maker or by a manager. Only the owner changes roles or hands the team over.

Every one of those rules is enforced by the API, not by the screen. The screen also disables the control and says why, so nobody discovers a limit by hitting it.

A record of every change

Apart from running a document review and asking the assistant, whose questions are kept in each notice's question history, every request that changes team data writes one audit row: who did it, which team, what object, and one sentence saying what happened. That covers pursuits and their stages, tasks, notes, go and no-go decisions, files, the company profile, certifications, past performance, alerts, scheduled reports, invitations, joining, removal, role changes, subscriptions and account deletion. An owner or admin reads the whole team's activity, filtered by person or by action; a member reads their own. Either can export what they see as a spreadsheet from the Activity page.

What the AI sees

The document review, the compliance checklist, the proposal outline, the questions for the contracting officer, Sources Sought letters, AI proposal drafts, plain English search, the assistant and Ask about InstantSam on this site are answered by a model from Anthropic. What is sent is the text of the solicitation documents and, for the assistant and plain English search, what you typed. Two features also send your company’s record, because what they write is about you: a Sources Sought letter and an AI proposal draft. Both send your company’s name, UEI, NAICS codes, set-asides, states and certifications, and the past performance you entered, including each reference’s name but never a reference’s email address or phone number. A letter also sends your CAGE code and contract numbers, and a draft also sends when your SAM registration expires and the competencies and differentiators you wrote. Documents and questions are processed to produce your answer and are not used to train models; we do not permit it, and our provider agreement does not allow it. Once a review or checklist exists for a notice, the assistant answers from those rather than re-reading the attachments, unless you ask it to.

The drafting guides and the proposal skeleton are built from your own checklist, outline and profile with no model call. A proposal draft is written by the model only when you ask for one, from that same material and your company record, and it stays private to your team.

Integrations

• An API key is shown once and stored as a SHA-256 hash; only its prefix is kept readable. Keys are read-only, limited to a thousand requests an hour, and can be revoked at any time from the Integrations page.
• Every webhook delivery is signed with HMAC-SHA256 over the timestamp and the body, with a secret you can rotate. Endpoints must be https, and localhost, local names and private or loopback IP addresses are refused. A failed delivery is tried again after one, two, four, eight and sixteen hours, and a failing endpoint is switched off after twenty consecutive failures.
• Payments on the website go through Stripe, and on iPhone and iPad through Apple; the Android app sells nothing. We never see or store a card number.

The website and the console

• No third-party script, pixel or tag loads on any page. There is no analytics or advertising cookie; the only cookies are the ones that keep you signed in.
• Pages are sent with a strict transport policy, may not be framed by any other site, forbid content sniffing, send a referrer policy, and grant no access to camera, microphone or location.
• Review text rendered from solicitation documents is neutralized before it reaches the page: no tag can be constructed from it and only http, https and mailto links survive.
• The API limits requests per caller and the assistant has a daily allowance per team, so a leaked token cannot run unattended.

How we run it

Secrets live in the hosting providers' configuration and never in code or in the repository. Access to production systems is limited to the people who operate the service and uses multi-factor authentication. Encrypted backups age out within 35 days. Retention periods for everything else, and exactly what is removed when you delete your account, are in the privacy policy, which is the document that binds us.

You can download the data held under your account from your account page, and delete the account in the app or on the delete account page, without asking anybody.

Questions a security review asks

Questionnaires and vulnerability reports

If your security or procurement team has a questionnaire, send it to support@instantsam.com and we will answer it in writing. If you have found a vulnerability, write to the same address with "Security" in the subject. A person reads it and answers within one business day, and we will tell you what we did about it.

Last reviewed 13 October 2026. InstantSam LLC, 6464 Savoy Drive, Suite 777, Houston, TX 77036.