Security and Data Boundaries

Data boundary

• Allowed: public company information, public-homepage text you are authorized to use, public past-performance descriptions, capabilities, NAICS, certifications, service locations, and search preferences.
• Not allowed: classified information, CUI, source-selection information, nonpublic acquisition data, proposal files, credentials, sensitive personal information, or third-party proprietary material.
• Every opportunity result and suggested NAICS code links to an official public source that the customer must verify.

Safeguards

• Bid Rigor-branded email and password access for invited businesses. Passwords are hashed; email verification and recovery links are one-time and expire.
• One-time sign-in links expire, cannot be reused, and can be revoked. Active sessions can also be ended immediately.
• Each customer’s profile, setup drafts, feedback, decisions, and delivery settings are kept separate from other customers.
• Sensitive actions are checked on the server, inputs and request frequency are limited, and service credentials are kept outside the website code.
• Known agency, keyword, deadline, location, and set-aside conflicts are checked by Bid Rigor’s matching controls and cannot be overridden by an AI suggestion.
• AI-assisted setup requires a separate customer choice and cannot change a company profile without the customer adding the item and saving.
• Commercial checkout is disabled during the free beta, and the service does not request payment-card details.

Public website review

Bid Rigor reads a company’s public HTTPS homepage only after the customer requests it and confirms authorization. It checks the site’s automated-access policy, does not sign in or submit forms, limits redirects and response size, and does not retain the raw HTML. A website that cannot be read safely can be replaced with a written company description.

AI boundary

Routine matching uses saved company criteria and available source evidence. Public document reading uses direct extraction where possible and shares reusable public results. Customer-requested AI reviews can supplement matching and opted-in briefs. Guided setup remains available without outside AI.

When a customer explicitly requests AI-assisted setup, Bid Rigor sends a sanitized company description and any separately approved public-homepage text to OpenAI for that request. It does not automatically include representative fields, login email, saved opportunity history, or account identifiers. Suggestions are limited to draft capabilities, keywords, stated exclusions, and NAICS candidates checked against the official catalog.

The customer reviews and adds each suggestion. Neither Bid Rigor nor the assistant determines certifications, size status, set-aside eligibility, clearances, contract vehicles, or legal eligibility.

Company evidence and drafts

Profile setup drafts are saved privately for the company and can be resumed or discarded. Draft fields do not change matching until the customer saves a valid profile. Company administrators can upload authorized business documents and confirm evidence about experience, capacity, qualifications, and commercial preferences.

When company AI decision support is enabled, requested reviews send the confirmed business evidence and relevant public passages to OpenAI. Uploaded files may be sent for extraction. File removal, evidence edits, disabling AI, and account deletion have distinct effects described in the Privacy Notice. Classified information, CUI, nonpublic procurement information, proposal material, credentials, sensitive personal information, and third-party confidential material remain prohibited.

Independent service

Bid Rigor is an independent product. It is not affiliated with, operated by, or endorsed by the United States Government or any state or local government.

Report a concern

Send suspected vulnerabilities or data incidents to security@bidrigor.com. Include the affected page and a concise description, but do not send credentials, exploit code that could harm other users, or protected Government information.