Security & privacy
Your bill of materials never leaves your browser
The free calculator runs entirely in your browser and transmits nothing. A saved determination on a paid plan holds the funding agency, your bill-of-materials lines and the verdict, and nothing else. Here is exactly what we hold, how it is scoped, and what we do not yet offer.
Principles
How Sourceory treats your bid data
The free calculator never transmits a bill of materials
Running one bill of materials in the free tier runs the same engine code as the paid product, entirely in your browser tab. The components, costs and origins you type never leave the page: there is no request to intercept, because none is made. This is why the engine has no dependency on anything server-side.
A saved determination holds your bid data, nothing more
A determination you choose to save on a paid plan stores the funding agency, the bill-of-materials lines you entered (component, category, cost and origin), and the verdict with the agency standard it was checked against, the fields the engine actually needs to reproduce its result. There is nothing to store beyond that, because the engine never asks for anything more.
Every user record is owner-scoped
Postgres Row Level Security scopes each row to the account that owns it across profiles, API keys, the request log and saved determinations. Another account's rows are not reachable through the app, the API, or a shared key.
API keys are hashed, shown once, revocable
We store a sha-256 hash of a key plus a short prefix so you can tell one from another. The key value itself is never written down. It is displayed once, at creation, and you can revoke it instantly from your account if it is ever exposed.
No file storage, because there is nothing to upload
Supabase Storage is disabled in our configuration. A bill of materials is a small set of typed fields (component, category, cost, origin), never a document or any other file, so there is no upload path and nothing sitting in a bucket to secure or to leak.
No model provider in the request path
Every verdict is a deterministic lookup against the cited OMB and agency ruleset in lib/engine, run in code. Nothing you enter, saved or not, is sent to a model or AI provider, and nothing is used to train one. Our MCP server lets an agent you control call the same deterministic engine; it does not send your account data anywhere else.
Guidance, not an official agency determination
Sourceory provides Build America, Buy America compliance guidance based on published OMB and agency sources. It is not legal advice and not an official agency determination or waiver. BABA guidance and waivers are updated over time and are fact-specific. Always confirm against the funding agency's current guidance and your grant terms before certifying compliance or applying for a waiver.
What we don't yet offer
- No SOC 2 report, or any other third-party security certification. We minimise what we store as an architecture decision, not a compliance program, and we will not assert a certification we have not earned.
- No third-party penetration test yet.
- No bug bounty programme. Report anything you find to us by email and we will act on it.
- No team seats and no SSO. An account is one person today.
We'd rather say this plainly than let silence imply a compliance status we haven't earned.
FAQ
Security questions
Is my bill of materials sent to your servers on the free tier?
No. A single free determination runs entirely in your browser and makes no network request at all, so there is nothing to secure in transit and nothing at rest on our servers for that determination. The BABA thresholds and waiver categories it checks against are public compliance data bundled with the app.
What does a saved determination on a paid plan actually store?
The funding agency, the bill-of-materials lines you entered (component, category, cost and origin), and the verdict with the agency standard it was checked against. That is the complete list. It is your commercial bid data and nothing more.
Do you store any files?
No. There is no file storage on this service, Supabase Storage is switched off, and there is nothing to upload beyond the typed bill-of-materials fields above.
Can other accounts see my saved determinations?
No. Row Level Security scopes every saved determination, API key and log row to the account that owns it, and there is no world-readable user data.
Is my data sent to an AI model?
No. No model or AI provider sits in the request path for a determination. Every verdict is a deterministic lookup against cited OMB and agency data, run in code. Our MCP server lets an AI agent you control call that same deterministic engine.
Do you offer a SOC 2 report or a penetration test?
Neither, and no bug bounty either. We say so plainly rather than implying a compliance status we have not earned. If one of those is a hard requirement for you, contact us before you build on the service.
Read the full privacy policy
Details on what we collect, why, and how to delete it.