Security & Data Handling

Current preview data flow

1. Uploaded PDF/XLSX/CSV/TXT/Markdown files are parsed by the browser for the preview workflow.
2. The extracted text needed for analysis is sent to the ProcureDeal backend.
3. The analysis service drafts answers from the supplied questionnaire and evidence text.
4. The current MVP stores lead metadata and summary counts; uploaded file binaries are not persisted by the preview workflow.
5. Generated output requires human review before buyer submission.

Evidence-first answer policy

The analysis workflow is instructed not to infer a certification, policy, control, security property, privacy commitment, training exclusion, human-oversight process or legal compliance position when supplied evidence does not support it. Unsupported questions should be marked partial or gap.

This distinction matters because security questionnaires create downstream commitments. A response that sounds plausible but cannot be traced to company evidence can create inconsistency between sales, security, legal and product teams. ProcureDeal is designed to surface that uncertainty before submission.

What the current MVP stores

The preview stores lead metadata needed to operate the service, including submitted work email, optional company name, questionnaire filename and summary counts from the analysis. The current upload flow parses file binaries in the browser; those uploaded binary files are not persisted by the preview workflow. Extracted text required for analysis is processed by the backend AI workflow.

Because the product is still evolving, this page should be read as a description of the current implementation rather than a permanent security architecture. Future capabilities such as accounts, durable document storage, payments or integrations may change the data flow and should be documented before release.

What we do not claim

We do not currently claim SOC 2, ISO 27001, penetration-test coverage, data residency guarantees or other certifications unless they are independently established and published. ProcureDeal is not a compliance certification service and generated answers still require human review.

Important limitation

ProcureDeal is still an MVP. Do not upload material you are not authorized to process through the service. Before using the product for highly sensitive enterprise data, complete your own vendor-risk and contractual review.