Where we stand on compliance, honestly
Our controls are aligned with NIST 800-171 and we operate CMMC Level 1 practices today. We are actively pursuing CMMC readiness and SOC 2 Type II, and we won't put a badge on this page until it's earned. If your compliance team has a security questionnaire, we'll fill it out.
Encryption in transit & at rest
All traffic is encrypted with TLS. Data at rest is encrypted on managed AWS and MongoDB Atlas infrastructure, including documents, proposals, and organization profiles.
Your data never trains public models
AI features run through enterprise API agreements, so your proposals, pipelines, and documents are not used to train foundation models. Your competitive edge stays yours.
Org-scoped isolation
Every document, chat, and search result is scoped to your organization. Retrieval and AI context assembly enforce organization boundaries at the query layer.
Strong authentication
12-character minimum passwords with complexity rules, TOTP two-factor authentication with encrypted secrets, rotating refresh tokens with device tracking, and progressive account lockout on failed attempts.
Role-based team access
Owner, admin, and member roles govern what teammates can see and do. Proposal-level access requests and approvals keep sensitive pursuits on a need-to-know basis.
Bot & abuse protection
Cloudflare Turnstile verification, layered rate limiting, and request throttling protect signup and public endpoints from automated abuse.
US-based infrastructure
Vulcan runs on AWS in US regions with containerized workloads, security headers, strict CORS, and audit logging of security-relevant events.
Responsible disclosure
Found something? Email info@blacksmithai.net and we'll respond promptly. We take every report seriously and credit good-faith researchers.
Your data works for you. Only you.
Everything you upload (past performance, capability statements, pricing history, partner data) exists to make yourproposals better. We don't sell it, share it across customers, or use it to train models. Delete your account and your organization's data goes with it.
Ask us a security question