How RFPilot protects access to your workspace and documents.

Registration and login. Accounts are created with an email address and password at /signup. Passwords are hashed with bcrypt before they are stored — the plain password is never persisted.

Password reset. Reset requests generate a single-use time-limited token which is emailed to the account owner. Setting a new password invalidates any active sessions for the account.

Session cookies. After sign-in, RFPilot issues short-lived access and refresh cookies. Both are marked HttpOnly, Secure and SameSite=Lax, so they are not readable by page scripts and are only sent over HTTPS.

Repeated-failure protection. After several unsuccessful sign-in attempts for the same account, additional attempts are blocked for a short cooling-off period.

Team roles. Each team member holds a role — owner, editor or reviewer. Backend endpoints check the caller's role before allowing changes to team membership, roles, projects or knowledge-base content. The account owner is the only role that can invite or remove team members.

Invite and share links. Team invitations use a single-use token that is delivered to the invitee's email address. Project share links are opt-in per project, generate a random token and grant read-only access to that project until the owner revokes the token.

Administrative access. The administrative dashboard is limited to accounts explicitly marked as admin in the database. It is not exposed to normal users.

RFPilot does not currently offer mandatory multi-factor authentication, SSO/SAML, SCIM provisioning or IP allowlisting.

Application records — projects, questions, knowledge-base entries, uploaded files and generated answers — are associated with the workspace that created them (their account_id). Backend endpoints authorize every read and write against the caller's account before returning or modifying data.

RFPilot is a shared multi-tenant service. Workspaces share the same application database and infrastructure; separation between workspaces is enforced by the application layer, not by physical database separation.

What you upload. RFPilot processes RFPs, security questionnaires, DDQs and knowledge-base source documents in the following formats: PDF, DOCX, XLSX and TXT. Uploaded files are stored inside the application database and are only accessible through authenticated endpoints scoped to their workspace.

Why we process it. Uploads are used to extract questions and requirements, retrieve relevant knowledge-base content, generate draft answers and produce the exported response document.

Editing and approval. Every generated answer is a draft — you can edit, add reviewers, mark answers as approved and only then export them. Human review is expected before an answer is treated as final. RFPilot does not warrant that generated content is accurate or complete.

Deleting content. Owners and editors can delete projects (which removes their questions and the associated uploaded source file), individual knowledge-base entries and generated answers from within the application. Deletion is performed against the live application database; backup lifecycle behavior is not separately documented on this page.

Provider. RFPilot uses OpenAI's API to generate draft responses.

What is sent. To draft an answer, RFPilot builds a prompt containing the question, relevant matched knowledge-base content and any workspace-provided company context (for example the company name, tone-of-voice sample and product description). Whole raw files are not sent to the AI provider directly — text extracted during upload is what feeds the retrieval and prompt steps.

Retention with the AI provider. How OpenAI stores and processes API requests is governed by the OpenAI account under which RFPilot operates and by OpenAI's own policies. The exact retention and training-use terms depend on the active provider account and configuration.

Human review. Generated responses should be reviewed by an authorized user before they are approved or exported. Assign items to teammates, verify the cited source, edit anything that needs refinement and only then approve.

Application code and API traffic run on Emergent's managed hosting platform. The application database is MongoDB. Uploaded files are stored inside the application database (they are not written to a separate object store). Transactional email is sent via Google's SMTP relay. Subscription payments are processed by Stripe. See the subprocessors table below for the full list of providers currently in use.

RFPilot does not publish a fixed data-storage region on this page. Each provider offers regions and processing locations described in its own documentation.

Content you control. Signed-in users can delete their own projects, knowledge-base entries and generated answers from within the application at any time. Deleting a project also deletes its questions and its uploaded source file.

Team membership. An owner can remove team members from the workspace; a removed member's own login continues to exist but no longer has access to the previous workspace.

Whole-account deletion. RFPilot does not currently expose a self-serve “delete my account” button in the product. To request deletion of your account and its associated workspace data, contact info@rfpilot.co. Related billing records may be retained where required for legal or tax purposes.

Backups. RFPilot does not publish a specific backup interval, retention window or restore time on this page. Deleting content in the live application removes it from the live database; separate backup lifecycles are managed by the underlying hosting provider.

Google Analytics 4 (GA4) is loaded on the public marketing pages. RFPilot uses Google Consent Mode v2: analytics storage is denied by default and is only granted after a visitor accepts analytics cookies through the consent banner.

Analytics events do not include uploaded document content, knowledge-base content, generated answer text, authentication tokens or contact-form message bodies. See the Cookie Policy for the categories of cookies used and how to change your consent.

Subscription payments are processed by Stripe. RFPilot does not store full payment-card details in its application database — payment-card information is collected and stored by Stripe. Trial, plan and invoice metadata (for example a billing email, current plan and subscription status) is stored in the RFPilot database to reflect your current subscription state.

See the Pricing page for available plans and trial terms.

RFPilot provides a contact channel for data-protection requests and describes its handling of personal information in the Privacy Policy. To request access to, correction or deletion of personal information associated with your account, email info@rfpilot.co from the address associated with the account.

If you believe you have identified a security issue affecting RFPilot, contact us with enough information to investigate the issue responsibly — a clear description, the affected URL or feature, and reproduction steps.

Email info@rfpilot.co or use the Contact page. Please do not include active credentials, private customer data or destructive proof-of-concept content in your report.

RFPilot does not currently operate a public bug-bounty program and does not guarantee a specific response deadline or public acknowledgement.