Security and data

• The database and files are on Amazon Web Services in the United States (us-east-1), run by Supabase. The app is hosted on Vercel.
• Data is encrypted in transit and at rest.
• Each company’s data is walled off from every other company’s inside the database itself, with row-level security on every table, not only in the app’s code.

• Every link is long and random, so it can’t be guessed.
• Proposal pages tell search engines not to index, follow or archive them.
• A link stops working the moment the sender archives the proposal.
• When a reader shares the proposal from the page, each colleague gets their own link, so the sender can see who read what and nobody needs to forward the original.

The sender sees that their proposal was opened, which sections were read and for how long, and who it was shared with. That’s the point of the product, and it’s all first-party.

• Readers never create an account, set a password or install anything.
• Repeat visits are counted with a one-way hash of the network address and browser. The address itself isn’t stored.
• Proposal pages load no advertising or analytics tags, ours or anyone else’s.

• AI drafts only when someone on your team asks it to, for example turning call notes into the problems the buyer described. The model is Anthropic’s Claude.
• Nothing AI drafts reaches a buyer until a person on your team approves it.
• AI never sets prices, discounts or contract terms. Those come only from what you enter.

• Sign in with Google, or with an email address and password.
• Owner, admin and seller roles. Sellers’ proposals stay private to them unless they share them with the company.
• Keys for connected services such as HubSpot stay on our servers and are never sent to a browser.

If you think you’ve found a security issue, tell us through the contact page and choose “Security”. Please give us a chance to fix it before telling anyone else. Our privacy policy covers what we collect and why.