The page to send to procurement.

Tenant isolation

Every business record carries an organization id, and row-level security policies in Postgres restrict each one to members of that organization. That check runs in the database, so it holds even if application code is wrong.

In the application, the organization is derived from the signed-in session and never from a URL or a request body — there is no parameter a caller can change to reach another tenant. A bid belonging to another organization returns “not found” rather than “forbidden”, because confirming that a record exists is itself worth withholding.

Authentication

• Google OAuth. Archer never sees or stores a password.
• Access is invite-only and keyed by email address. An uninvited account can complete sign-in and still has zero access.
• Sessions are httpOnly, Secure, SameSite cookies, refreshed server-side on each request.
• Roles are owner, admin and member, held per organization.

Data at rest and in transit

• TLS on every connection, with HTTPS enforced at the edge.
• Postgres and object storage are encrypted at rest by the platform provider.
• Uploaded solicitations live in a private storage bucket, namespaced by organization id, with no public URLs.

Where AI is used, and where it is not

Solicitation text is sent to Anthropic’s Claude API to extract requirements. Anthropic does not train models on API inputs. Nothing else is sent to a model: your pricing rates, bid history, company profile and win rates never leave Archer’s own infrastructure.

Extraction can be turned off entirely. Archer then falls back to a local keyword pre-scan and no document content leaves our systems — useful if a solicitation is under an NDA that forbids third-party processing.

Subprocessors

• Supabase — database, authentication, object storage.
• Vercel — application hosting and edge network.
• Anthropic — requirement extraction from solicitation text only.
• Google — identity provider for sign-in.

What we have not done yet

Stated plainly, because a security questionnaire will ask and a vague answer wastes everyone’s time: Archer has no SOC 2 report, no third-party penetration test, and no formal incident response plan at this stage. It has no single sign-on beyond Google, and no customer-managed encryption keys.

update this section as each one lands

Reporting a vulnerability

Report it to security contact address and we will acknowledge within two business days. Please do not test against another organization’s data.