Security and data handling

Last updated: October 11, 2026

This page says how FedReady protects your information, and only what we actually do. FedReady is run by one person (see About), so it also says what we don't have. The privacy policy covers what we collect and why.

What we do

• HTTPS only. Every page on fedready.us is served over HTTPS, and the site tells browsers to use HTTPS every time.
• Passwords are hashed. We store your password only as a salted hash (scrypt), which can't be turned back into the password. We can't read it or email it to you, which is why a forgotten password is reset, not looked up.
• Sign-in cookie. One cookie keeps you signed in. It holds a random code that page scripts can't read, and it's sent only over HTTPS. Our database keeps only a hash of that code. A session ends after 30 days without a visit, and you can sign out your other devices in Account settings.
• Password guessing is slowed. We count recent failed sign-in attempts and block a run of them.
• Your files are private. Uploaded files sit in private storage. We hand out download links only to your account, and they expire quickly.
• We never see your card. Stripe handles payment. We keep only your Stripe customer and subscription IDs, your plan and its status.
• Links you share are yours to turn off. A share link or calendar link shows only what you chose to share, and you can turn it off or reset it at any time.
• No selling, no ad tracking. We don't sell or rent your information, and we don't use advertising cookies.

Who handles your data

These companies process information for us, only to run FedReady. To look things up, we also send search terms to public government services (SAM.gov and USAspending.gov), and never your name or email address.

• Vercel. Hosts the website, and measures visits with Vercel Web Analytics.
• Supabase. Hosts our database and the private storage for the files you upload.
• Resend. Delivers the emails we send you: alerts, password resets and confirmations.
• Stripe. Takes payment for paid plans. You enter your card on Stripe's own page.
• Anthropic. Runs the Claude AI models behind the AI features, for the content each one needs.
• Google Analytics. Counts visits, with its advertising features turned off.

AI features and your data

For AI features (notice summaries, bid/no-bid briefs, proposal drafts and profile drafts from your website), we send Anthropic the content each one needs: the notice and its attachments, and where the feature needs them, your business profile, past performance, the proposal you're working on, or the website you give us. Under Anthropic's commercial terms it doesn't use that content to train its models. AI output can be wrong, so check it before you rely on it. The privacy policy has the details.

Deleting your data

You can delete your account in Account settings (it asks for your password). That cancels any subscription and permanently removes your account, business profile, saved opportunities, notes, documents and uploaded files, past performance library, outreach contacts, share links and calendar link, and takes down your public profile. There's no download-your-data button yet. Email hello@fedready.us if you need a copy of your information, or want something deleted without an account.

What we don't have

FedReady doesn't hold a SOC 2, ISO 27001 or FedRAMP certification, and we don't claim to. We don't publish a security audit or a penetration test report. If your company needs one to buy a tool, FedReady isn't the right fit yet, and we'd rather say so now. Our providers publish their own security documentation.

Report a security problem

If you think you've found a security problem, email hello@fedready.us with “Security” in the subject. Tell us what you found and how to see it. Please don't access other people's accounts or data to prove it, and give us time to fix it before you share it.