Security you can verify.
ProposalForge is Protected B aligned. Its application runtime, database, file storage, AI processing and document text extraction run in Canadian regions in Montreal. This page states what is in place, what is planned, and how to request the evidence.
Posture summary
Protected B aligned
Controls designed to support Protected B work. ProposalForge has not been formally assessed, and it is not certified or authorized by a Government of Canada department or by any other body. The control matrix in the pack shows what is in place and what is planned.
Data location
The database, authentication and file storage run on Supabase in AWS ca-central-1 (Montreal). The application runtime, AI processing and document text extraction run on Google Cloud in northamerica-northeast1 (Montreal), which also holds the daily backup copy of uploaded files. The subprocessor list below names the providers outside the Canadian regions and what each receives.
AI in Canada
AI features use Google Vertex AI in the Montreal region, called from the application runtime in Montreal. ProposalForge sends customer content to no other AI provider.
Encryption
TLS 1.2 or higher in transit, with HSTS; plain HTTP is redirected to HTTPS. AES-256 at rest on the database, file storage and secret store, with keys managed by the providers.
Sign-in and access
Role-based access from read-only viewer to organization administrator. For privileged roles, multi-factor authentication is required to sign in to the web application, and again before privileged actions such as team, token and administration changes. API tokens are scoped, shown once and stored only as a hash.
Tenant isolation
Row-level security on the tables that hold customer data, keyed to your organization, for every request made with a signed-in user's session. Private storage buckets with per-organization folders and matching access policies. Server-side work that uses a privileged database connection relies on the application's organization and role checks.
Control domains
One line per CCCS Medium Cloud Control Profile family. The gated pack carries the full matrix with control identifiers, implementation status and available evidence.
Access control
Role-based access from read-only viewer to organization administrator. Row-level security keyed to your organization on the tables that hold customer data, application checks on privileged server-side work, and rate-limited sign-in.
Audit and accountability
Create, update, delete, export, approval, settings, access-control and multi-factor events are logged with the user, action, time and outcome. Records are kept in the Canadian database for at least one year (a floor the database enforces); your administrator can set a longer period.
Security assessment and authorization
Automated security testing during development and in the build pipeline. ProposalForge has not been formally assessed and holds no authorization to operate from a Government of Canada department. An external penetration test is planned; the Testing section below gives its target quarter.
Configuration management
The container image and the build pipeline are defined as code and version-controlled, and each release records its build identity. Security headers on application responses, and required configuration is validated at startup.
Contingency planning
Daily database backups, kept for 7 days by the database provider; point in time recovery is not enabled. Uploaded files are not included in the database backups; they are copied daily to a private, versioned backup bucket in Montreal, where replaced or deleted versions are kept for 30 days. Generated exports are not backed up. Recovery point objective for the database: 24 hours. Recovery time objective: 4 hours.
Identification and authentication
For privileged roles, multi-factor authentication is required to sign in to the web application, and again before privileged actions such as team, token and administration changes. Passwords are stored as salted hashes, sessions use short-lived access tokens, and API tokens are scoped and stored only as a hash.
Incident response
A written plan with four severity levels. Customers are notified within 72 hours of ProposalForge confirming a breach affecting their data.
Physical and environmental protection
Provided by the data-centre operators in the Montreal region, which hold SOC 2 reports and ISO 27001 certification.
Planning
The security architecture and data flows are documented in the pack and summarized in the diagram on this page.
Risk assessment
Weekly dependency update proposals, secret scanning on every push to the code repository, a dependency audit before each pack edition, and a container scan that stops a deployment on a critical finding that has a fix available.
System and services acquisition
Providers are assessed for region, certifications and the data they may receive; the result is the subprocessor list on this page. The build pipeline runs type checking, linting and a container scan before a release is deployed.
System and communications protection
TLS 1.2 or higher, with HSTS. Private document storage buckets, application secrets in a managed secret store, and AES-256 encryption at rest for the database and file storage in Canadian regions.
System and information integrity
Weekly dependency update proposals, health checks, cloud monitoring (the service's health-check, error-rate, resource and edge-throttling alerts notify the team by email), and a deployment gate that refuses a revision that fails its readiness check.
Subprocessors
The providers that store or receive data from the ProposalForge service, what each does, where it is located, and the data it receives. Updated 2026-09-25.
Customer content means content held in the application: uploaded documents, proposals and library records, including the text taken from them for AI processing. A provider marked as receiving customer content stores or processes it. Email that someone chooses to send to our company addresses is not customer content in this sense; the list shows where that email is held.
| Provider | Service | Location | Purpose | Data categories | Assurance |
|---|---|---|---|---|---|
| Supabase, Inc. Receives customer content | Managed PostgreSQL database, authentication and file storage | Montreal, Canada (AWS ca-central-1). Supabase serves its API through Cloudflare's network, its own provider. | Application database, user accounts and sessions, private storage for uploaded documents and generated exports, and the audit log |
| SOC 2 Type II, ISO 27001 |
| Google Cloud (Google LLC) Receives customer content | Cloud Run, Vertex AI, Document AI, Cloud Storage, Cloud Tasks, Cloud Scheduler, Cloud Logging, Artifact Registry, Secret Manager, and the HTTPS load balancer with Cloud CDN | Montreal, Canada (northamerica-northeast1). Application logs written before 25 September 2026 were held in a global Google Cloud location and are deleted by 25 October 2026. Not all Secret Manager secrets are region-restricted. Requests enter through Google's global HTTPS load balancer, where TLS ends at the edge location nearest the user, and Cloud CDN keeps copies of public pages at Google's edge locations. | Application runtime, AI processing, document text extraction and its temporary staging, the daily backup copy of uploaded files, background jobs, application logs, container images and API credentials |
| SOC 2, ISO 27001, ISO 27017, ISO 27018 |
| Resend (Plus Five Five, Inc.) No customer content | Email delivery | United States | Sends application email: invitations, reminders, notifications, digests and account notices |
| SOC 2 Type II |
| Google Workspace (Google LLC) No customer content | Company email | United States (global infrastructure) | Hosts ProposalForge's own mailboxes, including the contact, security and support escalation addresses |
| SOC 2, ISO 27001, ISO 27017, ISO 27018 |
| Stripe, Inc. No customer content | Subscription billing and payment processing | United States (global infrastructure) | Plan subscriptions, invoices and card payments |
| PCI Service Provider Level 1, SOC 2 Type II |
| Upstash, Inc. No customer content | Managed Redis | Canada, Germany and the United States (a global database with replicas in AWS ca-central-1, eu-central-1 and us-east-2) | Rate limiting and a cache of public open-government data and rendered public pages of the website |
| None listed |
| Google Analytics and Google Ads (Google LLC) No customer content | Marketing site analytics and advertising measurement | United States | Page views, interactions and conversions on the public pages, including the sign-in, sign-up and password pages. The tags are not loaded when a signed-in application page is opened directly, and measurement is switched off inside the application. |
| None listed |
| Cal.com, Inc. No customer content | Demo booking calendar, embedded on the public demo page | United States | Lets a visitor book a product demo |
| SOC 2 Type II, ISO 27001 |
Data flows
Where a request goes inside the Canadian regions in Montreal, and what is sent to providers outside them.
Resilience
Daily database backups, kept for 7 days and held by the database provider. Point in time recovery is not enabled. Uploaded files are not included in the database backups; they are copied daily to a private, versioned backup bucket in Montreal, where replaced or deleted versions are kept for 30 days. Generated exports are not backed up; they can be produced again.
Recovery point objective for the database: 24 hours. Recovery time objective: 4 hours.
Last database restore drill: 2026-09-25, restored and verified in 7 minutes (within the 4-hour target).
Testing
- Dependency updates
- Dependabot, weekly: pull requests proposing newer versions of the application's packages, the container base image and the continuous-integration actions.
- Secret scanning
- gitleaks on every push to the hosted code repository, on every branch.
- Dependency audit
- npm audit of production dependencies before every pack edition; each high or critical finding is fixed or recorded as an exception with a reason and an expiry date.
- Container scanning
- Trivy in the build pipeline; a critical vulnerability that has a published fix stops the deployment unless it has a documented, expiring exception.
- Web application scan
- OWASP ZAP baseline before every pack edition, unauthenticated and as a signed-in read-only user.
Most recent unauthenticated web scan: 2026-09-25. OWASP ZAP baseline: 1 high (found on review to be a false positive), 6 medium, 10 low, 10 informational. Most recent authenticated (read-only user) web scan: 2026-09-25. OWASP ZAP baseline: 1 high (found on review to be a false positive), 7 medium, 11 low, 9 informational.
ProposalForge has not yet had an external penetration test. One by an independent firm is targeted for Q4 2027, and the executive summary of its report will be included in the first pack edition that follows the test.
SOC 2
ProposalForge does not hold a SOC 2 report of its own. Its principal infrastructure providers (Google Cloud and Supabase) hold SOC 2 reports. Each publishes its compliance information on its own site: Google Cloud at cloud.google.com/compliance and Supabase at supabase.com/security, both linked in the subprocessor list. A first-party SOC 2 report will be pursued when customers require it.
Statement dated 2026-09-25.
Vulnerability disclosure policy
Scope
proposalforge.io and its subdomains, the ProposalForge web application and its API.
Out of scope
- Our providers' own infrastructure (report those to the provider).
- Denial of service, and automated scanning that degrades the service for others.
- Social engineering of our staff or our customers, and physical attacks.
- Findings that require a compromised device or account.
Safe harbour
If you follow this policy, act in good faith, avoid privacy violations and service disruption, do not access or change data that is not yours, and give us a reasonable time to fix an issue before you disclose it, we will not pursue legal action against you and we will work with you.
How to report
Email security@proposalforge.io with the steps to reproduce, the affected URL or endpoint, and the impact you observed. Our security.txt is at /.well-known/security.txt.
What to expect
- Acknowledgement within 3 business days.
- A first assessment within 10 business days.
- Fixes for confirmed high-severity issues targeted within 30 days, and we tell you when the fix ships.
- Credit on request. There is no paid bounty program at this time.
Request the full evidence pack
One PDF: the control matrix with implementation status, the architecture and data flows, the incident response summary, the backup and recovery summary, the security testing summary, and the subprocessor list. A person reviews each request, and we aim to do so within two business days. An approved requester receives a download link that is valid for seven days and can be used once.
Looking for the overview? See the compliance page.
Questions for your security review?
We can walk your reviewer through the controls, the data flows and the evidence.