Interactive demo · no sign-in
The right source, next to every question.
This is SolveRFP’s review screen, preloaded with our own data: SolveRFP answering a vendor-security questionnaire about itself, from our public security page and our own Answer Bank. Approve, edit, reject. The keyboard works too.
What this is, and isn’t
Every answer below is a real, current claim about SolveRFP. This page doesn’t run the drafting engine: nothing was uploaded and nobody is signed in. It’s the review experience with our real answers preloaded, so you can feel the workflow before creating an account. In the product, drafts are generated from your documents, every quotation is checked against your source text by a deterministic checker, and anything unbacked is refused, like the FedRAMP question below.
- High confidence→ writes to D2
Is customer data encrypted in transit and at rest?
Yes. TLS in transit; encryption at rest via Supabase. The privileged service role is used only by the offline worker, never in a user-facing request path.
solverfp.com/security · Encryption✓ verifiedTLS in transit; encryption at rest via Supabase.
- High confidence→ writes to D3
Describe how you isolate one customer's data from another's.
Each customer is an organization. Every tenant table carries an org_id with deny-by-default Row-Level Security, and every query is scoped to the caller's org. A cross-tenant leak test is a required CI check, and merges are blocked on failure.
solverfp.com/security · Data isolation✓ verifieddeny-by-default Row-Level Security
- High confidenceReused from the Answer Bank→ writes to D4
Is your AI trained on customer data?
No. SolveRFP trains no models. Not on your data, not on anyone's. Anthropic's commercial terms prohibit training on customer content, and Voyage is configured with training opt-out and zero data retention.
Reused from the Answer Bank✓ verifiedNo. SolveRFP trains no models. Not on your data, not on anyone's. Anthropic's commercial terms prohibit training on customer content, and Voyage is configured with training opt-out and zero data retention.
- Needs reviewReused · reworded question→ writes to D5
What controls prevent commingling of client information with that of other clients?
Each customer is an organization. Every tenant table carries an org_id with deny-by-default Row-Level Security, and every query is scoped to the caller's org. A cross-tenant leak test is a required CI check, and merges are blocked on failure.
Reused from the Answer Bank✓ verifiedEach customer is an organization. Every tenant table carries an org_id with deny-by-default Row-Level Security, and every query is scoped to the caller's org. A cross-tenant leak test is a required CI check, and merges are blocked on failure.
- High confidence→ writes to D6
Do you maintain a list of third-party subprocessors, and is it available to customers?
Yes. The full list, with each subprocessor's purpose and a last-updated date, is public at solverfp.com/security.
solverfp.com/security · Subprocessors✓ verifiedLast updated: 27 July 2026.
- High confidence→ writes to D7
What customer data is shared with your AI providers?
Only the specific question text and retrieved snippets (top-20 retrieved, reranked to 6) are sent, never the whole document set or Answer Bank.
solverfp.com/security · No-train & data usage✓ verifiedonly the specific question text and retrieved snippets
- High confidence→ writes to D8
Can customers delete their data, and how?
Yes, self-serve. An organization owner can permanently delete the organization from Settings → Security. Deletion removes every tenant table, erases uploaded files from object storage, and deletes member identities that belong only to that organization.
solverfp.com/security · Retention & deletion✓ verifiedpermanently delete the organization from Settings → Security
- Needs review→ writes to D9
Which security certifications or attestations do you hold (SOC 2, ISO 27001)?
None yet. We are early and hold no formal certification, and we claim none. The controls we do run (tenant isolation, encryption, no-train, self-serve deletion) are documented publicly and enforced in code.
solverfp.com/security · Compliance✓ verifiedhold no formal certification yet
- No source→ writes to D10
Are you FedRAMP authorized or listed in the FedRAMP marketplace?
No source in the knowledge base. Edit to answer manually, or mark N/A.
- No source→ writes to D11Edited & approved
How often do you perform third-party penetration tests?
We have not yet commissioned a third-party penetration test. Static analysis and dependency scanning (Snyk) run in CI and block merges on high-severity findings.
Reviewed
Reviewing vendor-security-review.xlsx · in the product, approved answers are written back into these exact cells and the same workbook is exported.
Now run it on the file a customer actually sent you.
Upload a questionnaire, seed the Answer Bank from answers you’ve already approved, and export the exact workbook back, answers written into the right cells. Free to start: draft and review up to 100 answers in total, no credit card.