These are the controls and boundaries we can state plainly. Where a commitment is contractual, the Terms control. Where it is about data handling, the Privacy Policy controls.
Controlled data stays outside GFIN.
GFIN is not authorized or accredited to receive, store, or process classified information, Controlled Unclassified Information (CUI) as defined in 32 CFR Part 2002, or technical data controlled under the International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR). Customers must not upload or submit such information. A government contractor should keep controlled information in an environment authorized under its own contracts and use GFIN for non-CUI pursuit work. If we reasonably believe content is controlled, we may remove it and will notify the customer.
Read the Terms & Conditions
Access is authenticated and scoped.
Users sign in through authenticated accounts. Authorization is role-based, service-to-service calls are authenticated, and operations follow least-privilege access. Your organization manages its own team membership, roles, and credentials.
Traffic and storage are protected.
We use TLS for data in transit, cloud storage access controls, security monitoring, and audit logging. No system is perfectly secure. We investigate suspected events and notify affected customers as described in the Terms and Privacy Policy.
AI processing is bounded.
We do not use customer proposal content, uploaded documents, prompts, chat history, generated drafts, organization profiles, or workspace data to train foundation models or third-party AI models. We use provider API or enterprise channels, disable provider training and restrict retention where supported, and do not send proposal content to a provider that cannot support confidential no-training processing for that workflow. You review AI outputs before use.
Read the Privacy Policy
We do not sell customer data.
We do not sell customer data or share proposal content with advertisers or data brokers. Service providers process data only to operate the platform, and the Privacy Policy describes the provider categories and the access rules.