Security and data handling

Last updated November 7, 2026

Counties and bidders trust us with information that matters. This page explains how FactWise protects it. County security teams can use it when they review us.

Where data lives

• FactWise is a US company.
• All data is stored on servers in the United States, including backups.
• Part of our engineering team works outside the United States. They build and test with made-up data and have no access to non-public data: Vault details, uploaded documents, or sealed bids.

Encryption

• All traffic uses HTTPS (TLS).
• Data is encrypted at rest.
• Federal tax IDs and uploaded documents are encrypted again by FactWise before they're stored. Only the last 4 digits of a tax ID are ever shown.

Accounts and sign-in

• No passwords to steal: you sign in with a one-time link that works for 15 minutes.
• Sign-in requests are rate-limited to stop abuse.
• You're signed out after 7 days without use, and after 30 days at most.
• You can see your signed-in devices and sign out of all of them in Settings.
• Requests from other websites that try to change your account are blocked.

Records of activity

• Every change to an account, and every download of sensitive data, is recorded with who, what and when.
• These records can't be edited or deleted, even by our own staff, until their retention ends.
• You can see your own account activity in Settings.

How FactWise collects county information

If you found this page from a request in your website logs, this is who we are and how our software behaves.

• FactWise is a private US company. We collect public notices (bids, quote requests, meeting agendas) that counties publish, and link every item back to the county's own page.
• Our software identifies itself in the request, for example FactWiseBidCollector/1.0 (+https://factwise.io/security).
• It reads robots.txt first and follows it, including any crawl delay.
• It goes slowly, about one request every few seconds to a site, and stops if a site asks it to slow down.
• It never signs in, and never works around a block, a CAPTCHA or a security check. If a site blocks us, we stop.
• We keep notice details (title, dates, links). We don't collect personal information about private individuals.

To ask questions, ask us to slow down, or ask us to stop, email security@factwise.io. We'll reply within 2 business days.

Accessibility

We build to WCAG 2.1 Level AA, the standard counties must meet under the ADA. See our accessibility statement.

If something goes wrong

If personal information is exposed, we notify affected customers without delay and follow each state's breach notification law.

Our security program

We're building our program to the AICPA SOC 2 Trust Services Criteria, and to GovRAMP for public-sector customers. We'll publish our audit status here as it progresses.

Report a security issue

Email security@factwise.io. We'll reply within 2 business days. Please don't access other people's data or disrupt the service while testing.