Security & Data Handling

Data Encryption

Encryption at Rest

All user data stored by RFPWise is encrypted using industry-standard Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256 for authentication). This includes:

• 📄Uploaded RFP documents (PDF, DOCX)
• 📋Extracted metadata and parsed content
• ✍️Generated proposal sections and drafts
• 👥Team member profiles and project histories
• 🔒Session metadata and billing information
• ⚙️Administrative data (licenses, orders)

Encryption in Transit

All communications between users and RFPWise servers occur over HTTPS with TLS encryption. This includes web interface interactions, API calls, and file uploads/downloads.

Access Control & Session Security

Session Isolation

Each proposal session is assigned a cryptographically random UUID (version 4), for:

• Unpredictability: UUIDs are generated using secure random number generators, making it computationally infeasible to guess another user's session.
• Path Traversal Prevention: Session IDs are validated against a strict regex pattern before any storage operations. Invalid IDs are rejected.
• Data Isolation: Each session's data lives in its own namespace, preventing cross-session data leakage.

Authentication Security

Administrative access is protected by multiple security layers:

• Password Hashing: All passwords are stored using PBKDF2-SHA256 with configurable iterations and salt—never plaintext.
• Brute Force Protection: Login endpoints are rate-limited to 10 attempts per hour per user and 30 per hour per IP.
• Session Management: Server-side sessions with configurable timeouts (default: 8 hours).

Cookie Security

Web Application Security

CSRF Protection

Cross-Site Request Forgery protection is implemented globally. Every state-changing request requires a valid CSRF token, which is:

• Generated uniquely for each session
• Embedded in HTML forms automatically
• Included in API requests via X-CSRFToken header
• Validated server-side before processing any mutation

Rate Limiting

Flask-Limiter prevents abuse and denial-of-service attacks:

• Login Endpoints: 10 requests/hour per user, 30 requests/hour per IP
• Public Forms: 10 requests/minute, 200 requests/day
• API Endpoints: Configurable per-endpoint limits based on resource intensity

File Upload Security

All file uploads are processed with multiple security measures:

• Filename Sanitization: Path traversal characters are removed and filenames normalized
• Size Limits: Maximum upload sizes enforced at the web server level
• Type Validation: File types validated before processing
• Immediate Encryption: Files are encrypted before being persisted to storage

Data Retention & Deletion

Automatic Data Purging

RFPWise implements automatic data purging to minimize the exposure window for sensitive proposal data:

• Session Data: Automatically deleted 24 hours after last modification
• Upload Cache: Temporary upload files purged within 24 hours
• Processing Artifacts: Intermediate files (extracted images, temporary PDFs) deleted within 12 hours

Retention periods can be configured to meet specific organizational requirements.

Data Portability

Users can export generated proposals in standard formats (DOCX) at any time before automatic purging. The portable .wise session file allows work to resume on different devices or after a session expires.

Infrastructure Security

Cloud Architecture

• AWS S3: Object storage with server-side encryption (SSE-AES256)
• Redis: In-memory caching for session management (encrypted connections)
• Render: Managed platform with automatic SSL certificates and DDoS protection
• Stripe: PCI-DSS compliant payment processing—RFPWise never handles raw card data

AI Provider Security

RFPWise uses OpenAI's API for content generation:

• No Training on Customer Data: OpenAI's API does not use submitted data for model training
• Data Retention: OpenAI retains API inputs for up to 30 days for abuse monitoring, then deletes
• Encrypted Transmission: All API calls made over HTTPS
• Enterprise Options: Zero-retention agreements available for enterprise deployments

Security Controls Summary

Enterprise Options

For organizations with additional security requirements, we offer:

• Custom data retention policies
• Single-tenant deployment options
• Zero-retention AI provider agreements
• Custom security assessments and audits