Plain-language security. No badges we haven't earned.

PrimeWright runs your bid pipeline, which means it holds sensitive business data. This is the control register: what we do, what it covers, and where the boundary is.

Last updated: August 12, 2026

Contact security Review controls

The register

What protects your work.

Each entry says what the control does. No certification theater.

01 / ACCESS

Tenant isolation, enforced twice

Every organization's data is isolated with Postgres row-level security. The database itself refuses to return another org's rows, not just the application code. Defense in depth: the app checks, and the database enforces.

02 / CRYPTOGRAPHY

Encrypted in transit, and where it counts at rest

All traffic to PrimeWright runs over TLS. Files in object storage are encrypted at rest (AES-256). Sensitive fields — BYOK API keys and sensitive onboarding documents — are encrypted at the application layer, never logged, and never returned to any client. The database volume itself is not disk-encrypted, so we don't claim it is.

03 / KEYS

Your own key, handled carefully

If you bring your own key for a supported AI provider (currently Anthropic or OpenAI), it's encrypted at rest, used only to run your jobs under your caps, and never displayed again once you save it (not to you, not to us, not in any log).

04 / FILES

A private namespace for your files

Every document you upload or generate lives under your org's own private storage namespace. Other tenants cannot read, list, or reach into it.

05 / RECOVERY

Backups with tested restores

Automated backups run on a regular schedule, and restores are actually tested, not just assumed to work. A backup nobody has restored is a guess, not a plan.

06 / MONITORING

Server-side error monitoring

Errors are captured server-side so problems get caught and fixed quickly. We monitor the system, not your bid content.

07 / OWNERSHIP

Export or delete, anytime

Your data is yours. You can export it or delete it whenever you want, with no support ticket required to get your own information out.

08 / BOUNDARY

Public-record data only

PrimeWright processes public-record federal solicitation data from SAM.gov. No classified, CUI, or export-controlled material is stored, and none should ever be uploaded.

We don't claim certifications we haven't earned.

No SOC 2 badge until there's a SOC 2 audit. If a claim isn't true yet, it isn't on this page.

Security contact

Report a security concern.

Found a vulnerability or have a security question? Email support@primewright.com and we'll respond promptly.