Trust · updated Oct 22, 2026
What we protect, and what we do not claim.
Small contractors get asked about security in every teaming agreement and questionnaire. Here is the honest answer, with where each claim comes from. If something here is wrong, email contact@lozortfederal.com and we will correct it.
In place
Built and checked in the product today
In place: Every firm is walled off. Each firm record carries your firm id, and the database refuses reads and writes across firms (Postgres row-level security).
Verified in code · migrations 0001 to 0062
In place: Encrypted in transit and at rest. Every browser and API connection uses TLS. Stored data is encrypted at rest by our database and hosting providers.
Supabase and Vercel · see sub-processors
In place: Key actions are logged. Who did what and when, for team changes, proposals, statements, teaming, compliance and firm profile edits. Owners and admins can read the log and export it.
Admin · Audit log
In place: AI drafts show their sources. Drafts are written from the notice, your firm profile and your files, and cite them. Nothing replaces your text until a person accepts it.
Proposal editor · Capability statements
In place: Your own AI key. AI drafting runs on your firm's own Anthropic key, billed to you by Anthropic. The key is stored encrypted and is never shown again.
Settings · AI keys
In progress
Started, with what is left
In progress: Two-step sign-in. Available to every member now. Required for owners and admins once we switch enforcement on.
Rolling out · Settings · Security
In progress: SOC 2. Not yet audited. We will say so plainly until a report exists.
Decision pending
Not claimed
So nobody assumes otherwise
Not claimed: Independent penetration test. Not done yet. When one is done we will publish a summary here.
Status as of Oct 2026
Not claimed: FedRAMP authorization. Mission Control is not FedRAMP authorized.
Status as of Oct 2026
Not claimed: Approved for CUI. Do not upload Controlled Unclassified Information or classified material. Keep CUI in a system that meets DFARS 252.204-7012.
Applies to every plan
Not claimed: Certifying your firm. We help you track and evidence CMMC, SAM and certifications. We do not certify or assess your firm.
Compliance
Sub-processors
Everyone who receives data from the product, taken from what the code calls. Beltway, our accounting product, runs as a separate service with its own list.
Services that process your data
These host, store, send or analyze data on our behalf.
| Service | What it does | What it receives |
|---|---|---|
| Supabase | Database, sign-in and file storage | Your firm's records and uploaded files, and the email addresses of people who sign in |
| Vercel | Hosting and page-view analytics | Page requests and page-view counts |
| Stripe | Payments and subscriptions | Billing contact and plan. Card details go straight to Stripe and never touch our servers |
| Resend | Email delivery for invites, alerts and digests | The recipient's email address and the message |
| Anthropic | AI drafting, only when your firm adds its own API key | The prompt and the excerpts of the notice, profile and files used for that draft, under your firm's own Anthropic account |
| Embeddings service run by Lozort Federal | Turns text from your uploaded files into search vectors, so drafts can find the right passage | Text from your uploaded files. Its address is set at deploy time |
Public data we read
Government sources we query. They receive search terms, never your firm's records.
| Service | What it does | What it receives |
|---|---|---|
| SAM.gov | Federal opportunities and entity registration | Search terms and public registration numbers only. No firm records or files |
| USASpending.gov | Public award history for recompete radar | Search terms only. No firm records or files |
| Texas SmartBuy (ESBD) | Texas state and local bid notices | Notice ids only. No firm records or files |
Loaded in your browser
Third-party scripts your browser fetches on its own.
| Service | What it does | What it receives |
|---|---|---|
| Microsoft Office.js | The script that lets the Word add-in run inside Word | Your browser requests the script when you open the add-in. We send it nothing |
| Google Fonts | Some of our emails ask for a web font | The reader's mail app requests the font when the email is opened. We send it nothing |