← Back to BidPilot AIData Security & Handling Notice — Private Beta
Effective date: October 6, 2026.
Use only non-confidential or appropriately sanitized material during the private beta. The current architecture is intentionally limited and is not an enterprise document-management environment.
Current safeguards and architecture
- Working company-profile and bid records are stored in the user's browser profile.
- BidPilot does not currently provide centralized customer accounts, role-based team access, or an encrypted cloud proposal repository.
- The application warns users to verify extracted requirements, scores, and generated content before submission.
- PDF import loads PDF.js from cdnjs over the internet.
Do not use the beta for
- Classified government information.
- Controlled Unclassified Information (CUI) unless and until the product is specifically designed and authorized for that use.
- Export-controlled technical data.
- Protected health information, payment-card data, Social Security numbers, or similarly sensitive personal information.
- Third-party confidential information you are not authorized to process.
User-side security practices
- Use a trusted, updated browser and device.
- Protect the device account with a strong password and appropriate screen lock.
- Avoid shared/public computers.
- Keep independent copies of important proposal records.
- Delete local records when they are no longer needed.
- Review every generated statement and supporting claim before submission.
Security representations
No claim is made that the private beta is FedRAMP-authorized, CMMC-certified/assessed, SOC 2 attested, ISO 27001 certified, HIPAA compliant, or otherwise approved for regulated or government-sensitive data.
Incident reporting
Users who suspect exposure of sensitive data should stop using the affected browser workspace, preserve relevant evidence, and contact mybidpilotai@gmail.com. Because this is a private beta, BidPilot AI does not represent that it provides a formal enterprise incident-response service or regulated breach-notification program.
Future production controls
Before accepting sensitive customer documents, a production architecture should be evaluated for authentication, encryption in transit and at rest, tenant isolation, access controls, logging, secure backups, retention/deletion controls, vulnerability management, incident response, and vendor/security reviews appropriate to the customer base.