---
title: 'Security'
url: 'https://piper-ai.com/security'
description: 'How Piper protects pursuit documents and bid data: encryption, org isolation, and vendor standards.'
updatedAt: '2026-11-02T13:19:11.200Z'
---

# Your bid data stays yours.

Piper reads pursuit documents to surface risk, requirements, and scope gaps. Here is how we protect what you upload: where it lives, who can see it, and what Piper never does with it.

- **Encrypted:** In transit and at rest
- **Org-isolated:** Logical separation or higher
- **SOC 2:** Type 2 attestation
- **Never:** Never used to train models shared with other customers, vendor or Piper

## Security and data governance standards

Where we stand today, stated plainly. Ask us for the latest status at any time.

### SOC 2 (Type 2)

Piper maintains SOC 2 Type 2 attestation with an independent compliance partner, covering security and privacy trust service principles for the Piper platform.

### Audited hosting

Piper runs on cloud infrastructure audited to SOC 2 Type 2, covering the servers and operating systems beneath our application under a shared responsibility model.

### Encrypted data platform and org isolation

Customer data is encrypted in transit and at rest. Each organization is isolated with logical separation or higher, so members only see their own workspace data.

### Security monitoring

Production systems are monitored for anomalies and known vulnerabilities, with findings tracked to closure.

### Independent assurance

Independent penetration testing and alignment with recognized security frameworks are complete on a recurring schedule.

## Control who sees what

The controls your IT team expects from any system that touches bid files and pursuit records.

- Secure authentication with password protection and optional multi-factor sign-in through your identity provider
- Organization-scoped workspaces with role-based access so admins control membership and permissions
- Logical separation or higher between customer organizations, so one cannot read another’s data
- Audit logging of security-relevant actions within the product
- Time-limited signed links for file access where uploads and downloads are required

## Your files, your boundary

Piper needs to read pursuit documents to analyze them. It does not need to exfiltrate them or reuse them outside your contract.

### Isolated storage

Documents stay in your organization’s storage boundary in supported deployments.

### Member-only access

Access is limited to authenticated members of your organization according to your roles and permissions.

### Never used for training

Customer content is not used to train models shared with other customers, including shared Piper models and vendor foundation models. API calls stay under no-training contract terms.

### SOC 2 compliant vendors

Subprocessors that store or process customer data are selected from vendors with SOC 2 or equivalent assurance.

### Export and deletion

Export and deletion requests are handled according to your agreement and applicable law.

## Multiple layers of defense

Security work that continues after launch, not a one-time checklist.

### Detect: Vulnerability scanning

Production is scanned for known vulnerabilities, and we keep watching for new ones.

### Maintain: Dependencies kept current

The code Piper is built on is checked automatically and kept up to date.

### Respond: Every finding fixed

Vulnerabilities are tracked and fixed by severity, and every exception is documented.

### Protect: Encryption in transit

Network encryption protects data between clients, Piper services, and storage.

Strict, least-privilege access for the Piper team, with ongoing security training and a written incident response plan.

## Questions your IT team will ask

### Can Piper change files in our systems without permission?

Piper analyzes documents you upload or connect according to your configuration. It does not silently write back to external systems without an explicit integration or action your team initiates.

### What encryption protects our data?

Data in transit is protected with TLS. Data at rest is encrypted using industry-standard mechanisms provided by our cloud platform and storage services.

### Who can see our pursuit documents inside Piper?

Only authenticated users in your organization, according to the roles and permissions your admins assign. Other Piper customers cannot access your workspace data.

### Is customer content used to train AI models?

Your bid and pursuit content is not used to train models shared with other customers, including shared Piper models and vendor foundation models. Product features may call model providers under contractual terms that restrict training on customer data.

### How do we report a security issue?

Email office@piper-ai.com with a description and steps to reproduce. We review reports promptly and coordinate disclosure with you.

Missing one? Email our security team (office@piper-ai.com)