Trust and security
Only statements that are true of the product today. Anything planned is labeled Roadmap. CanAdd does not currently hold SOC 2, FedRAMP or CMMC certification.
Company-isolated workspace
Database rules only return records for companies you belong to.
Encrypted in transit and at rest
HTTPS on every connection. Stored files and records are encrypted by our hosting provider.
Not used to train AI models
Your documents and pricing are never used to train third-party models.
Official federal sources
Notices come from SAM.gov, Grants.gov and USAspending, cited by notice ID.
You control submission
CanAdd prepares and checks. A person on your team reviews and submits.
The CanAdd web application runs on Vercel. Your account, company records, analyses and uploaded files are stored in a Supabase project (managed Postgres database, authentication and file storage). Payments are handled by Stripe; card numbers go directly to Stripe and are never stored by CanAdd.
All traffic to CanAdd uses HTTPS (TLS). Supabase encrypts the database and stored files at rest with provider-managed keys.
Accounts sign in through Supabase Auth with email and password or Google and Microsoft sign-in. Password reset links are sent to the account email.
Every company record, document and analysis belongs to one company workspace. Row-level security policies in the database only return rows for companies you are a member of, and server functions verify your active company before reading or writing. Secrets and privileged database access stay in server code.
Files you upload are stored in private storage buckets that are never publicly addressable and require an authorized, time-limited link. They are private to your company and used only to produce that company's readiness checks and analyses. We do not use your documents to train third-party models.
You can delete individual documents, analyses and proposals from the app at any time, which removes the stored file and its extracted text. Reports can be exported. To export everything or close your account, write to support@canadd.io from your account email; workspace data is deleted within thirty days, except billing records we must keep.
Ace answers only from your company's own records in CanAdd and official public sources such as SAM.gov and federal regulations, and cites the record or section behind each answer. When the evidence is not there, Ace says what is missing instead of guessing. Ace never reads another company's data.
Do not upload classified or export-controlled material. See the Privacy Policy for subprocessors and your rights.
Check your readiness free