Reason is built and hosted on infrastructure that federal procurement teams can audit. Here is exactly what we do — and what we don't — to protect your capture data, PWIN scoring, and proposal IP.
Every claim below maps to a specific architectural choice in our codebase or hosting configuration. If a procurement officer wants verification, point them here.
All browser traffic is terminated at the Render edge with TLS 1.2 or higher — HTTP is forced to HTTPS at the platform level. Application-to-database traffic is likewise SSL when the connection is not localhost.
Our Postgres instance runs on Neon, which encrypts underlying storage with AES-256. User passwords are never stored in plaintext — we hash with bcrypt before persistence. Auth tokens are signed with a server-held secret.
password_hashSessions are JWTs delivered as httpOnly, sameSite=lax cookies. Every query layer is scoped by organization_id, so users only ever see their own org's opportunities, captures, and proposals. Server-side role checks gate admin actions.
httpOnly auth cookies · 7-day expirySingle sign-on is not turned on by default. We support SAML 2.0 and OIDC, scoped per organization, and activate it for Enterprise-tier customers during onboarding. If your agency requires SCIM or federated identity, we'll wire it in.
Sign-ins, opportunity edits, PWIN score runs, and Stripe webhook events are all written to an internal event log we can replay. This gives you a forensic trail — not a tamper-evident SOC-style audit chain (yet).
Application code runs on Render with health-checked deploys. The database is a managed Neon Postgres instance with provider-side backups. There is no on-prem component, no developer direct DB access in production, and no shared credentials.
Honest timelines. We don't claim certifications we don't have yet.
SOC 2 readiness assessment in progress. Background-checked engineers, change-controlled deploys, and the access controls described above. No current attestation — we will not represent this section as certified.
Point-in-time attestation covering security and availability trust criteria. We will publish the report summary under NDA on request once issued.
Type II covers an operating window — typically 6 to 12 months — and we plan to start the observation period in late 2026. FedRAMP Moderate authorization requires a sponsoring agency; we are open to conversations with interested partners.
Reason is a tool for working with federal-buyer data — not a marketplace. We do not sell, share, or train models on your data.
ANTHROPIC_BASE_URL) to produce component breakdowns and what-must-change-to-win analysis. Inputs are scoped to your opportunity and org; we do not retain model inputs beyond the active session. All scores, signals, and explainability artifacts are stored on your org's Neon Postgres tenant.
organization_sam_settings; we make the calls on your behalf, store the resulting opportunity records by sam_solicitation_id, and never transmit your key to a third party. Nightly sync runs as an idempotent job that upserts rather than duplicates.
email and a bcrypt password_hash per user. Session tokens are JWTs signed with a server-held secret and delivered as httpOnly cookies. Password reset tokens are single-use and expire automatically.
polsia.toml. Each run executes as an isolated job against your org's key with exponential backoff on rate-limit responses. Job logs are retained for operational review.
We commit to acknowledging security reports within two business days, providing an initial assessment within ten, and working with you on coordinated disclosure.
Email security@reasongov.comWhat to include: a clear repro, expected vs. actual behavior, and any logs you can safely share (no PII). Our promise: no legal action against good-faith research, encrypted-channel response on request, and a 90-day coordinated-disclosure window as our default goal.
If your agency or program office is evaluating Reason, we’ll walk your team through this security posture, the sub-processor list, and the data-flow architecture in a 30-minute call.
Request a Briefing →Use your official government or company email — we’ll be in touch within two business days from security@reasongov.com.
Yes. Application hosting is on Render (U.S. regions) and Postgres runs on Neon, which is U.S.-based and U.S.-operated. All customer data, including PWIN scoring inputs and proposal drafts, stays in U.S. data centers; we have no international data flows for customer content.
Our sub-processors today: Render (hosting), Neon (Postgres), Polsia AI Proxy (model calls), and Stripe (payments). SAM.gov is read-only via per-org keys. Send a request to security@reasongov.com and we'll send the current list with DPA references.
Our target breach-notification window is 72 hours from confirmed incident to customer notification, consistent with GDPR/CCPA expectations. Notification goes to the org owner contacts we have on file, with a written summary, scope, and remediation steps. We do not promise this in advance for incidents we cannot yet characterize — only that we will move at that speed.
Reason does not control or classify content you upload. You decide whether the material you store or generate through Reason is controlled under ITAR, EAR, or agency-specific marking. Reason itself does not ingest controlled technical data without your direction in plain-text solicitation context; treat the platform as a tool, and your data classification rules apply.
Org owners can request account and data deletion from the team settings page or by emailing us. We delete the organization, its users, opportunities, captures, and proposals from production Postgres within 30 days, and rotated backups within 90 days. We will confirm deletion in writing.
We treat DFARS 252.204-7012 (Safeguarding Covered Defense Information) flow-downs as a contract-level conversation. Once SOC 2 Type 1 is issued we can provide the report and a NIST 800-171 self-assessment narrative for review. If a particular clause requires a CUI handling environment, that's the kind of requirement we'd scope a dedicated deployment against.