What we store, where it is kept, and who can read it

Your account

Your name, email address, company and state. Your password, which is stored as a hash and never as the password itself. Your plan, the seats on your account and who holds them. Your watchlist, saved views, alert settings and how much of your monthly allowance you have used. Messages you send us, through the contact form or with Send us a message inside the app. A short record of account events: the sign-up, the first time the app is opened each day, plan changes, invitations and messages.

You can change your own email address and password inside the app. Both ask for your current password. A new address has to confirm from a link sent to it before anything changes, and changing the password signs out every other session.

What you type into the working systems

The product is also where the work is done, so it stores what you enter there:

• Bid worksheets: labor categories, hours, rates and prices.
• Contract records: funding, costs, invoices and deliverables.
• The books: your staff list and pay rates, timesheets and the log of every change to them, what payroll paid, the cost ledger, and the rate sets worked out from them.
• Pipeline entries, notes, tasks and reviews.
• Capture plans, bid decisions and the weights behind them, and readiness answers.
• Your facilities, equipment, capabilities and where you perform, and how many people hold a clearance at each level. Counts only, never a name.
• Messages between the people on your account and the files sent with them, read only by the people in the conversation, or for a conversation on a record by those who may open the record.
• Your company's own handbook pages and their versions, the terms it adds to the Glossary, and each person's progress in the courses.
• The roles your account defines, and which systems each person may open.

All of it belongs to your account. People who hold a seat on the account can read it, and what a seat can change depends on the role the owner gives it: a member works in the account, a viewer reads and changes nothing, a manager also invites and removes seats, and an advisor reads everything and changes only the proposal work, pursuits and tasks. Pay rates and pay runs are closed to a seat until the owner opens them for that seat. Nobody on another account can read any of it. See seats and roles. None of it is ever counted into a price band, a win rate, a score or any other figure this site or the app publishes. Those are built from the federal record alone.

Documents you upload

Paid plans include a document library, and a contract record can carry attachments. This is how an uploaded file is handled.

• What it takes. PDF, DOCX, DOC, RTF, TXT, MD, CSV, JSON, XLSX, XLS, PPTX, PNG, JPG and JPEG. Anything else is refused by name and nothing is kept.
• How much. Shop holds 250 files or 1 GB. Pro holds 1,000 files or 5 GB. Capture holds 5,000 files or 20 GB. Enterprise holds 25,000 files or 50 GB. One file can be up to 50 MB.
• Where it is kept. In a private area on our servers that is never served over the web.
• Who can read it. It is read back only through the app, and only by people on the same account.
• What it is used for. Matching your own documents to the requirements of a solicitation, and laying out the first draft of a proposal with your own passages under each requirement. Both are done with no AI. AI writing in a draft is optional and off until the account turns it on. The next section says what it sends.
• Deleting. You can delete any document at any time. When an account is closed, its documents are deleted.
• If you stop paying. An account that drops back to One Code can still download and delete what it uploaded.
• What not to upload yet. Controlled unclassified information (CUI). The service does not yet meet the rules for holding it, so do not upload CUI to the library or type it into a record.

What goes to an AI model

When you ask for a reading, the AI provider is sent your question and the facts on the screen you asked about. On a federal record that is the published record. On your own pursuit, bid, contract or books it includes what you entered there, because that is what you asked it to read. The screen itself is not sent: the app says where you are and what you asked, and the facts are read again on our servers. Your account details are not sent, and a reading is never sent a document from your library.

AI writing in a proposal draft is optional, and it is off until you turn it on. The draft of a proposal is built with no AI: the parts, your own passages under each requirement, the gaps and the Word file. AI writing stays off for an account until its owner or a manager turns it on, on the draft screen, after reading what is sent and confirming it. They can turn it off again at any time.

When it is on, pressing "Write this part from my passages" on one part of a draft sends three things for that one press: the requirement sentences of that part, the passages of your own documents shown under them, and your company name. Nothing else in your library is sent, and nothing is sent until somebody presses that button. A passage is a paragraph of a document, or part of one. The file is never sent, and neither is its name. What comes back is shown beside your text as a suggestion and is never saved over what you wrote.

AI in Agreements is optional too, and it is off until you turn it on. Agreements are kept, read clause by clause, approved and signed with no AI. AI in Agreements stays off for an account until its owner or a manager turns it on, on the AI tab of an agreement, after reading what is sent and to whom and confirming it. They can turn it off again at any time.

When it is on, each press of one of its buttons sends, for that one press: the text of the agreement it is about, or for a question across your agreements only the passages of the agreements that match it; the question, when there is one; and your company name. A review or a first draft also sends your own playbook positions or clause language for the clauses concerned. They go to the AI provider that writes for this product, or to the provider of the account's own AI key when it has one. A restricted agreement is sent only when the person asking may read it. What comes back is checked against the agreement before anybody sees it: a sentence that names no part of it is removed, and so is a number that is not in the part it names. Every answer is marked as AI and kept on the agreement's history with who asked and when, and nothing is written to an agreement until a person confirms it.

If you add an AI key of your own, it is encrypted before it is stored, with a key that is kept apart from the data. It is used only to write your own account's readings, briefs and questions, and a part of a proposal draft where the account has turned AI writing on, and AI in Agreements where the account has turned it on. It is never shown again in full, only its last four characters, and the account owner can remove it at any time.

We do not use anything you type, watch, save or upload to train a model.

Sign-in and sessions

You sign in with your email address and password, and a session is kept in a cookie. A new account opens once its email address is confirmed from the link we send to it. Sign-ups are screened for automated attempts, and one network can only make so many in a day. API keys on the Capture and Enterprise plans are shown once, stored as a hash, and can be replaced from the account page, which revokes the old one.

The Security screen, under Administration in the app, is on every plan and is where each person controls their own way in:

• Two-step sign-in. After the password, a six-digit code from an authenticator app, which changes every thirty seconds and works once. The key the app is set up with is shown once, while it is being set up, and is stored sealed so that a copy of the database alone does not give it back. Ten recovery codes are shown once and kept only as hashes, each good once.
• Trusted browsers. A browser can be trusted for thirty days so the code is not asked for each time. Changing your password ends every trust at once, and any one can be ended from the screen.
• Failed sign-ins. Five that do not match in fifteen minutes pause that name from that address, for longer each time, up to a day. The pause says the same whether or not the name has an account.
• The lock screen. After the minutes you choose without input (five, fifteen, thirty or sixty), the session is locked on our servers and asks for your password or a code before anything else is shown or done. Lock it at once from the menu, or with Ctrl+Shift+L.
• Sessions and history. Every place you are signed in, with its browser, system, address and times, and a way to end one or every other. Your last fifty sign-ins and security changes.

The owner of an account can require two-step sign-in for everybody on it, set the longest a session may stay unlocked, see who has two-step on, and end a person's sessions. Every sign-in, failed sign-in, change to two-step, use of a recovery code, lock and ended session is a line in the account's history. No code, key or password is ever written to a log.

Payments

Payment is taken by the payment processor, which holds the card. We do not store card numbers. We hold the processor's customer reference and your plan. You can cancel from the account page and keep the paid plan to the end of the period you paid for.

Email

Alert digests are plain-text emails, and every one carries a one-click stop link. The newsletter is sent only to an address that has confirmed it, and every issue carries an unsubscribe link. We do not sell or share addresses.

Taking your work with you

Your work is yours to take. The owner can download everything the account holds as one file: every list, every record and every document. A seat can download its own watches, views and settings. It is asked for on the account screen in the app.

What we never ask for

Your SAM.gov login. Access to your email inbox. Anything from an employer or a private list. The product does not need any of them.