Security & Data Handling — RFPForge

Our Approach

RFPForge is designed for general commercial RFP and proposal workflows. We aim to use reasonable administrative, technical, and organizational safeguards, while keeping our claims aligned with the platform's actual implementation and operating model.

RFPForge is not currently certified under SOC 2, ISO 27001, HIPAA, or similar enterprise compliance frameworks, and it is not intended for emergency, life-critical, or real-time operational use.

Data Handling

Temporary uploaded source files are removed after processing completes.
Deleting a document from Document Library removes that file and its indexed workspace knowledge chunks.
Extracted content, embeddings, and related records may remain available while needed for workspace features.
Account deletion requests are currently handled through manual support review.

AI Processing

RFPForge relies on configured third-party AI and embedding providers for inference.
We aim to minimize the information sent to providers to what is needed for the requested feature.
We do not use customer content to train RFPForge-operated foundation models or shared AI systems.

Infrastructure

We apply safeguards for data in transit and at rest.
User content is logically isolated at the application and database levels.
Knowledge retrieval, document access, and deletion actions are scoped to the active workspace identity.
Authentication, operational logging, and service monitoring are used to help operate and protect the platform.

Billing

Dodo Payments acts as the merchant of record for paid subscriptions.
Billing data is processed through Dodo Payments and related billing infrastructure rather than stored as raw card data by RFPForge.
Refunds and cancellations are handled according to our published billing and refund policies.

Availability

RFPForge is provided on a best-effort basis. We do not currently offer a formal uptime SLA, dedicated incident response commitments, or guaranteed uninterrupted availability.