Security and data handling

FedScope combines public federal records with private workspace context. Watchlists, relationships, chat history, decisions, and performance documents can be competitively sensitive even when they are not government-controlled information. The controls below describe the current product.

Our core commitments

• We do not sell workspace data. Account details, watchlists, searches, and private context are used to provide FedScope, not sold, rented, or shared for advertising.
• We do not use Vault documents or account data to train AI models. Some natural-language searches may use a configured model provider after deterministic parsing. Vault file contents are not sent through the current search flow.
• The Vault is private by default. A document is available only to its owner or a verified company holding an active grant. Grants are explicit and revocable.

Workspace and database access

Workspace membership and row-level security are enforced in the database, not only in the browser. Private chat projects, sessions, and messages are owner-scoped. A member of the same workspace does not automatically receive another member's chat history.

The chat @ lookup follows the same boundary. It can list current workspace members and active, non-CUI Vault files the current company owns or can access. The server revalidates every selected reference when a message is sent. A reference does not notify a person, grant access, or share chat.

Vault controls

• Vault files use private storage with no public read policy.
• Downloads use short-lived signed URLs and forced download disposition.
• Grant, revoke, view, and download activity is access-logged. Security-sensitive link issuance fails closed when its required audit write fails.
• Document sharing requires verified companies and an accepted teaming relationship.
• Revoking a grant blocks future access immediately, but cannot undo a completed download.

See Past-performance Vault for upload, sharing, and evidence rules.

Platform practices

• Traffic uses TLS and infrastructure storage encryption at rest.
• Administrative credentials remain server-side and are not included in browser bundles.
• CI scans for leaked credentials, and product services use narrowly scoped credentials.
• Payment card entry is handled by Stripe; FedScope does not receive or store full card numbers.
• API responses containing private workspace information use private, no-store caching directives.

CUI and compliance boundaries

FedScope has not completed a SOC 2 audit. A future CUI-capable offering would require a separately defined system boundary, documented controls and evidence, incident response, supplier and personnel requirements, assessment, and ongoing monitoring. It will not be described as compliant before the applicable requirements have been implemented and assessed.

Responsible disclosure

Report a suspected vulnerability to support@fedscope.io. Include the affected surface and enough reproduction detail for us to investigate, but do not include sensitive customer information in email.

Related: Privacy policy, Data sources, and What FedScope cannot tell you.