Security & Data Practices

Tenant isolation

• Company DNA, pursuit analyses, portfolio decisions and subscription records are scoped to a single company account.
• Row-level security is enabled on customer data tables, and access is granted only to authenticated members of the owning company.
• Cross-tenant reads are not possible through the application API.

Where decisions are computed

• All scoring, gate evaluation and evidence generation run server-side. Decision logic is never executed in the browser.
• Third-party opportunity-source credentials are held server-side only and are never sent to a browser.
• Public, no-login features evaluate solicitation evidence only. They never read Company DNA or any tenant record.

Authentication and access

• Accounts authenticate over an established identity provider with session tokens.
• Every protected server call revalidates the caller's session server-side.
• Administrative capabilities are role-gated in the database, not in the browser.

Payments

Subscription payments are processed by Stripe. RADSVI does not receive, store or process full card numbers.

Data retention and deletion

Customer data is retained while the account is active. To request export or deletion of your company's data, contact support@radsvi.com.

Reporting a security issue

Email support@radsvi.com with the subject line "Security". Please include reproduction steps and avoid accessing data that is not yours.