Private business documents, isolated organizations, and public solicitation data.

Data isolation

Every private record is scoped to an organization in server-side authorization. Object keys are not public URLs, and downloads verify organization ownership against private storage metadata before returning bytes.

Application protections

• HTTP-only, SameSite session cookies and server-side identity checks
• Prepared database queries, input validation, rate limits, and webhook signature verification
• SSRF-resistant website crawling with protocol, address, redirect, page, time, and size limits
• File signature checks, executable rejection, sanitized names, size limits, and cryptographic checksums
• Secret isolation, redacted operational logs, idempotent jobs, and audit records for material decisions

Uploads

Do not upload classified information, CUI, ITAR-controlled information, export-controlled technical data, Social Security numbers, banking credentials, or any data you are not authorized to store.

Honest security claims

PursuitSense does not claim FedRAMP, CMMC, SOC 2, HIPAA, or other certifications it has not earned. Security questions can be sent to austin@pursuitsense.com.