Security

Last updated September 4, 2026. Short on purpose: what we do, what we do not do, and what is on you.

What we store

Your company profile and past performance, the text extracted from solicitation attachments you upload or pull from SAM.gov, the analyses and drafts the desk produces, and the operational records a login system needs (hashed passwords, session versions, rate limits, an email log). Public notice data from SAM.gov is public record. We store no card numbers; Stripe does.

Where it runs

On servers in the United States. The database is backed up nightly to a second machine and kept for about five weeks; a restore is tested when the backup job changes. Deleting your workspace removes it from the live database immediately and from the backups as they age out.

Which AI reads your material

Analyses and drafts are produced by OpenRouter with the model google/gemini-3.7-flash, routed to the provider serving that model with data collection disabled. Your material is sent to produce your analysis and for nothing else; it is not used to train models. Every compliance-matrix row carries a quote that our software checks against the material you supplied, and rows whose quote cannot be found are marked unverified. Quote checks do not establish factual accuracy or complete requirement coverage. Proposal exports and print views require a recorded review confirmation.

What you must not upload

Public solicitation material and your own company information only. WorthChase is not an authorized system for Controlled Unclassified Information (CUI), export-controlled technical data (ITAR or EAR), or classified material, and it is not covered by DFARS 252.204-7012 flow-down. If a document carries such markings, keep it out. You make that determination; the terms say the same.

What we do not have yet

• No FedRAMP authorization, CMMC assessment, or SOC 2 report.
• No two-factor authentication yet; sessions are signed, HttpOnly, and revocable from Settings.
• No guarantee that every person with production access is a U.S. person.

If your work requires any of those, WorthChase is not the right tool for that work today. We would rather say so here than in a breach notice.

Questions

Write to support@worthchase.com. The privacy policy covers retention and your rights in more detail.