Built for people who bid on defense work
Your pipeline, pricing and proposals are competition-sensitive. This page says exactly what protects them today, with nothing rounded up. Where a control is still ahead of us, it says so.
Last verified against the code: September 29, 2026
Where Vulcan runs
Vulcan runs on Amazon Web Services in the us-east-1 region (Northern Virginia), as containers on ECS Fargate behind an Application Load Balancer, with AWS FIPS endpoints turned on. The database is MongoDB Atlas on AWS us-east-1. The cache is Redis Cloud in us-east-1 and the search index is Pinecone in the United States.
There is no on-premise server. Production credentials live in AWS Secrets Manager and are read by the containers at launch; they are never in the browser.
Encryption
Traffic between your browser and Vulcan is encrypted with TLS, ending at the load balancer inside AWS. Data at rest is encrypted by MongoDB Atlas and by Amazon S3, which encrypt their storage by default.
Two things get an extra layer before they are stored: the credentials of any app you connect (HubSpot, Salesforce, Atlassian and the rest) and your two-factor secrets, both encrypted with AES-256-GCM under keys held only in Secrets Manager. Card details never reach our servers; Stripe holds them.
Sign-in and sessions
Sign-in is built into Vulcan; there is no third-party identity provider in the path. What it does:
- Passwords are stored as bcrypt hashes, never in clear.
- A session token lasts 15 minutes and is renewed while you work. You are signed out after 60 minutes idle, and after 24 hours regardless. Up to 10 devices can be signed in at once, and you can end any of them from Settings.
- Five wrong passwords lock the account for 5 minutes, doubling on each repeat up to an hour.
- Two-factor sign-in with an authenticator app, a passkey (Face ID, Touch ID, Windows Hello or a security key), or an email code. Sign in with Google or Microsoft is available.
- Session cookies are HttpOnly, Secure and SameSite strict; every write carries a CSRF token; sign-in, sign-up and the API are rate limited.
- Owner, admin and member roles decide what teammates can see and do.
Company isolation, tested
Every record in Vulcan carries the company it belongs to, and every request is answered only from the signed-in company's records. We do not take that on trust: a test suite signs in as one made-up company and tries every one of the 492 API routes that touch company data against a second made-up company's records, reading and writing, 914 probes in all. As of 29 September 2026: zero leaks.
The check runs in our continuous integration suite. A new route that touches company data fails the build until it has been probed and its results committed.
Backups and recovery
The database is backed up by MongoDB Atlas Cloud Backup: a snapshot every 6 hours kept for 2 days, then daily snapshots for 7 days, weekly for 4 weeks, monthly for 12 months and yearly for a year. The most a restore can lose is 6 hours of changes. A failed snapshot emails us. Files in S3 are versioned, and a prior version is kept for 90 days after an overwrite or delete.
We have written the restore procedure but have not yet run a timed restore drill. When we do, the measured recovery time will be published here.
Monitoring and deploys
Errors go to Sentry with personal data stripped and every on-screen text masked in session replays. Server logs are kept in CloudWatch for 365 days. A bad release is rolled back automatically by the deploy circuit breaker before it takes traffic.
AI and your data
Vulcan calls Anthropic, OpenAI and Perplexity through our own proxy inside AWS, under commercial API terms that do not use your data to train models. Documents handed to a model are fenced as data, not instructions, in the writers, shredders and reviewers. The full list of who processes what is below.
We do not sell your data and we do not share it between customers. Delete your account and your organization's data goes with it; you can also download it from Settings at any time.
Who processes your data
Every outside service that can receive data from Vulcan, what it gets, and where it runs. This list is generated from the credentials our production servers actually hold, and a test fails our build if a new credential appears without a row here. The same table is in the Vulcan Privacy Policy, which promises 30 days' notice before a new vendor processes your content.
Inside Vulcan
| Vendor | Purpose | Data | Region |
|---|---|---|---|
| Anthropic | AI models (Claude) for chat, writing, document analysis and review | Prompts, documents and context you submit for AI processing | United States |
| OpenAI | Embeddings for search over your documents, company-file and resume extraction, and chat when you pick a GPT model | Document text and search queries (embeddings); files, resumes and prompts you submit for extraction or chat | United States |
| Perplexity | Web-grounded research in Search and in Chat when web search is on | Search queries and the context needed to answer them | United States |
| Google (Gemini) | AI models (Gemini) when you pick one in Vulcan AI | Prompts, documents and context you submit for AI processing | United States |
| xAI | AI models (Grok) when you pick one in Vulcan AI | Prompts, documents and context you submit for AI processing | United States |
| Mistral AI | AI models (Mistral) when you pick one in Vulcan AI | Prompts, documents and context you submit for AI processing | United States (a French company; Vulcan calls its US-hosted service) |
| Together AI | Open-weight models (Llama, DeepSeek, Qwen, Kimi, GLM) when you pick one in Vulcan AI; they run on Together's servers, never on the model maker's | Prompts, documents and context you submit for AI processing | United States |
| NVIDIA | AI models (Nemotron, Phi) when you pick one in Vulcan AI | Prompts, documents and context you submit for AI processing | United States |
| Cohere | AI models (Command) when you pick one in Vulcan AI | Prompts, documents and context you submit for AI processing | United States |
| Meta | AI models (Llama) when you pick one in Vulcan AI | Prompts, documents and context you submit for AI processing | United States |
| Hugging Face | AI models (Phi) when you pick one in Vulcan AI | Prompts, documents and context you submit for AI processing | United States |
| Amazon Web Services | Hosting (ECS Fargate, us-east-1), file storage (S3), job queues (SQS), logging and secrets | All Service data at rest and in transit | United States (us-east-1) |
| MongoDB Atlas | Primary database, including uploaded files kept in the database | Account, organization, chat, pursuit, proposal, contact, file and usage records | United States (AWS us-east-1) |
| Pinecone | Vector index for semantic search over your documents, one namespace per organization | Embeddings and short text chunks of documents you upload | United States |
| Redis Cloud (Redis Ltd.) | Cache, chat working memory and rate-limit counters | Short-lived copies of chat context and request counters; nothing kept only here | United States (us-east-1) |
| Stripe | Payments, subscriptions and invoices | Name, email, billing address, payment method (card details never touch our servers) | United States |
| Google Workspace (Gmail SMTP) | Transactional email delivery | Email address and the content of account, team, support and notification emails | United States |
| ElevenLabs | Text to speech when you play a chat reply aloud | The text of the reply being read aloud | United States |
| Cloudflare | Turnstile bot protection on sign-up and public forms; DNS | Browser signals used to tell people from bots | Global |
| Sentry (Functional Software) | Error and performance monitoring for the app and its servers | Error reports and timings with your user ID, organization ID, page and browser; personal data scrubbed; session replays with all on-screen text masked | United States |
| PostHog | Product analytics: which screens and features are used, so we can improve Vulcan | Page views and five named actions (sign-in, proposal created, file uploaded, search run, export) with your user ID and organization ID, never your email or name; session replays with every input and all on-screen text masked | United States |
| Serper | Web search results for Chat, Search, export-control and travel lookups | Search queries | United States |
| Logo.dev | Company logos from a website domain | Company website domains | United States |
| Twelve Data and Yahoo Finance | Public market data for company research | Ticker symbols | United States |
| Mapbox | Maps and geocoding in Atlas Forge | Addresses and coordinates you place on the map | United States |
| SAM.gov, Grants.gov, SBIR.gov and international tender portals | Public procurement data feeding Search | Your search queries; these sources send us public notices, not your data | Various government systems |
| Google and Microsoft (sign-in) | Sign in with Google or Microsoft | Your name, email and profile photo at sign-in | United States |
Only when you connect an app
| Vendor | Purpose | Data | Region |
|---|---|---|---|
| Connected apps: Google Workspace, Microsoft 365, HubSpot, Salesforce, Atlassian, LinkedIn | Optional connectors you turn on in Settings; data flows from the app into Vulcan, then to the AI model you picked | Only the data within the scopes you approve, only while the connector is on | United States |
The marketing site only (blacksmithai.net)
| Vendor | Purpose | Data | Region |
|---|---|---|---|
| Vercel | Hosting for the marketing site blacksmithai.net | Visitor requests to the marketing site (IP address, pages viewed) | United States (global edge) |
| Sanity | Blog content for the marketing site | None of yours; it serves our published articles | United States |
| Google Analytics | Visit statistics for the marketing site | Pages viewed on the marketing site and browser signals; not used inside Vulcan | United States |
Where we stand on compliance, honestly
No badge goes on this page until it is earned. If your compliance team has a questionnaire, we will fill it out from the same facts as this page; the DFARS 252.204-7012 one-pager is here.
- SOC 2
- No report yet. We will start an audit when a customer contract needs one, and say so here.
- Penetration test
- Not yet done by a third party. Our own isolation and injection tests run in CI; a third-party test is planned once a named deal calls for it.
- NIST SP 800-171
- Our design target for handling controlled information, not an assessed status.
- CMMC
- Vulcan makes no CMMC certification claim. The CMMC program's Phase 2 was suspended on 13 July 2026 (Class Deviation 2026-O0025 Rev 3, 3 September 2026); we watch the program and will update this line when it changes.
- FedRAMP
- Not authorized and not in progress.
- Accessibility
- WCAG 2.1 AA is the target; see the accessibility statement for what is checked today.
Found something?
Email security@blacksmithai.net. We acknowledge every report within three business days, and good-faith research under our vulnerability disclosure policy is welcome. The machine-readable version is security.txt. Our accessibility statement is here too. For anything else about your account, write to support@blacksmithai.net; we answer within three business days.
Ask us a security question