Security & Data Handling

This page explains how SBIR Signal handles submitted capability statements, uploaded files, account credentials, and payment information on sbirsignal.com.

Capability statements & uploaded files

• Retention to power matching & workspace features. Submitted capability statements (pasted text and uploaded PDF/DOCX files) are retained to power capability matching, saved capability profiles, shareable match reports, readiness scorecards, and workspace features as new SBIR/STTR and defense-innovation topics open.
• Deletion on request. You can delete saved capability profiles from your account or request deletion of your account and retained capability statements at any time by emailing sbirsignal@gmail.com.
• Unclassified summaries only. Do not submit classified information, Controlled Unclassified Information (CUI), ITAR/EAR-controlled technical data, or proprietary source code. Submit only unclassified capability summaries suitable for public solicitation matching.

AI scoring & processing

When AI scoring is enabled, capability statement text and public solicitation descriptions are transmitted over encrypted TLS connections to our AI inference provider to compute topic-fit scores, why-it-fits and watch-out rationale, and pursue-kit briefs. We do not sell your capability statements or share your saved capability profiles with other customers.

Account, transport & payment security

• Transport & browser protections. Traffic is served over HTTPS/TLS with HTTP Strict Transport Security (HSTS) in production, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and clickjacking protection (X-Frame-Options: SAMEORIGIN and CSP frame-ancestors 'self').
• Authentication. Passwords are stored as salted cryptographic hashes — never in plaintext — and sessions use signed cookies.
• Payments via Stripe. Paid plans are processed through Stripe Checkout. Full card numbers are entered on Stripe and never touch SBIR Signal servers.

Public federal data

Award and solicitation records on SBIR Signal are ingested from official public U.S. government sources, including USASpending.gov, SBIR.gov, DoD SBIR/STTR Topics (DSIP), and SAM.gov.

Contact & deletion requests

For security questions, data-deletion requests, or vulnerability reports, email sbirsignal@gmail.com. Related: Privacy Policy · Terms of Use · About SBIR Signal.