Your bid data stays yours.
Piper reads pursuit documents to surface risk, requirements, and scope gaps. Here is how we protect what you upload: where it lives, who can see it, and what Piper never does with it.
Encrypted
In transit and at rest
Org-isolated
Logical separation or higher
SOC 2
Type 2 attestation
Never
Never used to train models shared with other customers, vendor or Piper
Security and data governance standards
Where we stand today, stated plainly. Ask us for the latest status at any time.
SOC 2 (Type 2)
Piper maintains SOC 2 Type 2 attestation with an independent compliance partner, covering security and privacy trust service principles for the Piper platform.
Audited hosting
Piper runs on cloud infrastructure audited to SOC 2 Type 2, covering the servers and operating systems beneath our application under a shared responsibility model.
Encrypted data platform and org isolation
Customer data is encrypted in transit and at rest. Each organization is isolated with logical separation or higher, so members only see their own workspace data.
Security monitoring
Production systems are monitored for anomalies and known vulnerabilities, with findings tracked to closure.
Independent assurance
Independent penetration testing and alignment with recognized security frameworks are complete on a recurring schedule.
Control who sees what
The controls your IT team expects from any system that touches bid files and pursuit records.
- Secure authentication with password protection and optional multi-factor sign-in through your identity provider
- Organization-scoped workspaces with role-based access so admins control membership and permissions
- Logical separation or higher between customer organizations, so one cannot read another’s data
- Audit logging of security-relevant actions within the product
- Time-limited signed links for file access where uploads and downloads are required
Your files, your boundary
Piper needs to read pursuit documents to analyze them. It does not need to exfiltrate them or reuse them outside your contract.
Isolated storage
Documents stay in your organization’s storage boundary in supported deployments.
Member-only access
Access is limited to authenticated members of your organization according to your roles and permissions.
Never used for training
Customer content is not used to train models shared with other customers, including shared Piper models and vendor foundation models. API calls stay under no-training contract terms.
SOC 2 compliant vendors
Subprocessors that store or process customer data are selected from vendors with SOC 2 or equivalent assurance.
Export and deletion
Export and deletion requests are handled according to your agreement and applicable law.
Multiple layers of defense
Security work that continues after launch, not a one-time checklist.
Detect
Vulnerability scanning
Production is scanned for known vulnerabilities, and we keep watching for new ones.
Maintain
Dependencies kept current
The code Piper is built on is checked automatically and kept up to date.
Respond
Every finding fixed
Vulnerabilities are tracked and fixed by severity, and every exception is documented.
Protect
Encryption in transit
Network encryption protects data between clients, Piper services, and storage.
Questions your IT team will ask
Missing one? Email our security team (office@piper-ai.com)
Can Piper change files in our systems without permission?
Piper analyzes documents you upload or connect according to your configuration. It does not silently write back to external systems without an explicit integration or action your team initiates.
What encryption protects our data?
Data in transit is protected with TLS. Data at rest is encrypted using industry-standard mechanisms provided by our cloud platform and storage services.
Who can see our pursuit documents inside Piper?
Only authenticated users in your organization, according to the roles and permissions your admins assign. Other Piper customers cannot access your workspace data.
Is customer content used to train AI models?
Your bid and pursuit content is not used to train models shared with other customers, including shared Piper models and vendor foundation models. Product features may call model providers under contractual terms that restrict training on customer data.
How do we report a security issue?
Email office@piper-ai.com with a description and steps to reproduce. We review reports promptly and coordinate disclosure with you.