Security & Data-Handling Boundaries

Use PursuitForge for public opportunity information and ordinary, non-sensitive business material that your organization permits you to share with its authorized company members.

Do not upload classified information, Controlled Unclassified Information (CUI), export-controlled technical data, source-selection information such as restricted CPARS evaluations, passwords or API keys, or sensitive personal data. Do not upload third-party confidential material unless your organization has confirmed that the intended use is permitted.

Controls in the current product

Company access: Company membership and role checks govern access to shared work. Database row-level security restricts company records. A public source link does not make the company’s notes or files public.
Private document storage: The company document bucket is private. Downloads require authenticated access and the existing storage permissions. Files are available to active company members with workspace access—not a public document directory.
Roles and edits: Owners, Admins, Reviewers and Viewers have different permissions. Viewer access is read-only; assignment and management permissions remain role-specific. Membership in one company does not grant access to another.
Administrative access: Privileged site administration requires a restricted account and an additional MFA check. This is not a claim that every customer account has mandatory MFA or enterprise single sign-on.
Advertising measurement: Optional Google Ads measurement is controlled through the site’s consent choice. Declining does not prevent product access. See the privacy notice for the applicable data practices.

These statements describe application behavior. They do not constitute an independent security audit, guarantee or government approval.

What we do not claim

No controlled-data authorization

This site does not claim that PursuitForge has a FedRAMP certification or authorization, CMMC status, SOC 2 report, or independently assessed NIST SP 800-171 conformity. A hosting provider’s credentials do not establish the same status for this application.

No automatic content clearance

Private storage, file-type restrictions and document review dates do not classify, sanitize or approve uploaded content. Do not rely on them to detect sensitive information or malware.

No implied procurement approval

A trial, subscription or product brief is not an agency authorization to use the service. Confirm organizational security, privacy, accessibility and procurement requirements before adoption.

No source-completeness guarantee

Imports may be delayed or incomplete. Recorded changes do not inspect attachment contents or detect a file replaced at the same URL. Official notices remain authoritative.

Before your organization adopts the service

Identify the data you intend to use, who needs access and which approval requirements apply. Ask for the specific evidence your review requires, including retention/deletion arrangements, incident contact, accessibility documentation, contract terms and any required independent assessments. Do not assume an unlisted capability, service-level commitment or certification is available.

Ask a security or data-handling question Privacy notice Terms

For a suspected security issue, use the contact page without including passwords, tokens, private documents or exploit data from another organization.

Reviewed September 17, 2026. Government and prime-contractor evaluation guide.