Legal

Subprocessors

Every outside service that handles customer data, what it receives and when it is used. Updated October 14, 2026.

This list is built from the services the Bids2Bank code actually calls. Where we have not checked where a provider processes data, the entry says so. We do not use your content to train AI models; AI providers receive it through their business APIs.

Always used

These run for every workspace.

Supabase

What it does: Database, file storage and sign-in (including sign-in and team invitation emails).
Data it receives: Everything stored in your workspace: account details, uploaded files, proposal text, pursuits, approvals, supplier contacts and audit records.
Location: United States: AWS us-west-2 (Oregon).

Vercel

What it does: Hosts the website and application and runs the server code.
Data it receives: Every request and response passes through it, including the content you view and upload; it keeps request logs.
Location: Pages are served from Vercel’s global network. Server-code region not confirmed: Vercel’s default is Washington, D.C. (iad1), and the project sets no other region in its configuration.

Anthropic

What it does: Primary AI model for drafting and checking proposal text, reviews, document extraction and reading supplier replies.
Data it receives: The text a step needs: solicitation sections, your evidence excerpts, draft sentences and, when used, supplier reply text. Sent through its business API.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

OpenAI

What it does: Turns uploaded documents into search embeddings, and is the second AI model when Anthropic is unavailable.
Data it receives: The text of documents you upload (to index them), and the same step text as Anthropic when it is used as the fallback model. Sent through its business API.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Inngest

What it does: Runs background and scheduled jobs (document indexing, the proposal pipeline, reviews, alerts, data imports).
Data it receives: Job events, which mostly carry workspace, record and user identifiers, and the results each job step returns, which Inngest stores so a job can resume; for some jobs these can include proposal content.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Sentry

What it does: Error reports, so failures are found and fixed.
Data it receives: Error details from the server and browser. Request bodies and cookies are dropped, and API keys, secrets, tokens and email addresses are masked before an event is sent.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Used only when a feature is used

These receive data only when the feature named in each entry is switched on or used.

Google (Gemini API)

What it does: Last fallback AI model, used when Anthropic and OpenAI are both unavailable.
Data it receives: The same step text as the other AI models, only when a request falls back this far. Sent through its business API.
When: Only when the first two AI providers fail for a request.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Stripe

What it does: Subscription billing, checkout, invoices and prepaid credit purchases.
Data it receives: Billing name, email, plan and payment details. Card numbers go directly to Stripe; Bids2Bank never sees them.
When: When you start a trial, subscribe or buy credits.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Resend

What it does: Sends email (saved-search digests and the quote requests you send to suppliers) and receives suppliers’ replies.
Data it receives: Recipient email addresses and the email content, supplier replies and their attachments, bounces and complaints.
When: When your workspace uses saved-search email alerts or sends supplier quote requests.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Google (Gmail API and sign-in)

What it does: Saves supplier quote requests as drafts in your own Gmail account.
Data it receives: The draft email (recipient, subject and body). Bids2Bank stores your Gmail refresh token encrypted and never stores access tokens.
When: Only after a team member connects their Gmail account.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Google (Programmable Search)

What it does: Web search for other potential suppliers of an item.
Data it receives: Search queries built from the solicitation: item name, part numbers, NSN and company names. No uploaded documents.
When: When supplier search is configured with this provider and you research suppliers.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Serper

What it does: Web search (Google results) for DIBBS supplier research.
Data it receives: Search queries built from the solicitation: item name, part numbers, NSN and approved-source company names. No uploaded documents.
When: When supplier research is configured with this provider and you research suppliers.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Brave Search

What it does: Web search for supplier research, as an alternative to the providers above.
Data it receives: Search queries built from the solicitation: item name, part numbers, NSN and company names. No uploaded documents.
When: When supplier search is configured with this provider and you research suppliers.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Firecrawl

What it does: Web search for supplier research, and reading supplier web pages that do not load without a browser.
Data it receives: Search queries built from the solicitation, and the addresses of public supplier pages to read. No uploaded documents.
When: When supplier search or page rendering is configured with this provider and you research suppliers.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Fly.io (antivirus scanner)

What it does: Hosts Bids2Bank’s own ClamAV scanner, which checks uploaded files for malware.
Data it receives: The bytes of each uploaded file, for the duration of the scan. The scanner does not keep them.
When: Only while the upload antivirus scanner is switched on for the service.
Location: United States: Ashburn, Virginia (iad).

Built, not yet in use

The code for these exists, but they do not receive customer data in production today. We list them so you can see what is coming before it starts.

Twilio

What it does: Texts and AI phone calls to suppliers, workspace phone numbers, and checks of whether a number is a landline.
Data it receives: Supplier phone numbers, text messages and replies, call audio while a call is in progress, and call records.
When: Built but not yet used in production. Texts and calls run only for workspaces that turn them on.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Fly.io (AI call service)

What it does: Hosts Bids2Bank’s own AI call service for supplier calls.
Data it receives: The call brief (your company name, callback number and reply email, the supplier and contact name, solicitation number, deadline and items), call audio streamed from Twilio while the call is in progress, and the transcript, which is returned to Bids2Bank. The call conversation also goes to Anthropic, Deepgram and Cartesia below.
When: Built but not yet used in production; AI calls go live only after a legal review of the call script and consent rules.
Location: United States: Ashburn, Virginia (iad).

Deepgram

What it does: Speech-to-text for the AI call service.
Data it receives: The supplier’s side of the call audio, while the call is in progress.
When: Used only by AI calls, which are not yet in production.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Cartesia

What it does: Text-to-speech for the AI call service.
Data it receives: The text the AI caller speaks, while the call is in progress.
When: Used only by AI calls, which are not yet in production.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Upstash (or Vercel KV)

What it does: Shared request counters for rate limiting across servers.
Data it receives: A counter per caller per minute, keyed by a SHA-256 hash of the API key, the signed-in user’s id, or the IP address. Counters expire after the window.
When: Not configured in production yet; until it is, counters stay in each server’s memory.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Audit archive storage (AWS S3 or Cloudflare R2; provider not chosen)

What it does: Daily signed copies of the audit records, kept outside the main database.
Data it receives: Audit-log rows and the sealed hand-off records (hashes, identifiers, counts and approvals).
When: Built but not configured in production; no provider has been chosen.
Location: Not chosen.

GitHub (Actions)

What it does: Nightly encrypted database backup with an automatic restore check.
Data it receives: An encrypted copy of the database, kept as a private 30-day build artifact.
When: Built and tested on sample data; not yet run against the production database.
Location: Not recorded by Bids2Bank; see the provider’s own terms.

Government data sources

These public government systems are where opportunity, award and regulation data comes from. They receive search queries from Bids2Bank, not your uploaded documents or proposal content, so they are not subprocessors.

SAM.gov (GSA)

Contract opportunities, entity registrations and exclusions.

Receives: Search terms and codes, notice ids, and the UEI or CAGE codes of your company and the partners you check.

USAspending.gov

Past awards, spending and prices.

Receives: Search filters such as NAICS, PSC/FSC, agency and your company’s UEI.

Grants.gov

Grant opportunities.

Receives: Search terms and filters.

DLA DIBBS

Defense Logistics Agency requests for quotation and their documents.

Receives: Requests for the day’s public files and for solicitation documents.

eCFR (Office of the Federal Register)

Full text of the FAR and DFARS.

Receives: Requests for regulation text.

Questions about this list: privacy@bids2bank.com. See also the Privacy Policy, the Data Processing Addendum and Trust & Security.