Find and win work
Stay compliant
Research and case law
Agents and integrations
Regulations and policy
Contracts and spending
Audit and compliance
GovConDash is designed to protect the company data government contractors and their advisors work with. Identifiers are masked before AI processing, data is encrypted in transit and at rest where it is sensitive, and your data is not used to train AI models.
The GovConDash logo and wordmark appear with the line Security, built in, and the four features the scene walks through: masking, encryption, access controls and the audit trail. Then the words Built and hosted in the United States appear over a map of the United States and the flag. Masking: in the Dashboard Agent, a contractor asks a question that names its company, contract number and email address. Before the question is sent to the AI model provider, GovConDash replaces each of those identifiers with a placeholder token such as [[ORG-1]]. The model answers with the tokens in place, GovConDash restores the real values in the answer shown to the user, and the audit record keeps the masked text with the token map encrypted to the account. Encryption: the browser shows the connection is secure, over HTTPS through Cloudflare's edge network, with plain HTTP redirected and HSTS. A saved incurred cost proposal is then shown as the database holds it, encrypted with AES-256-GCM and bound to the account. Access controls: on the sign-in page the user chooses Continue with Google, with Microsoft and email and password also offered. The request passes the server's checks (verified session, plan, account scope), and sessions are protected by lockout after repeated failed attempts and sign-out after inactivity. Audit trail: the AI Audit Trail lists each AI run; one entry opens to show the prompt as the user sent it, and the trail is exported to Excel.The scene closes on the GovConDash lockup and the four features.
How GovConDash protects your data: masking, encryption, access controls and the audit trail. An illustration with a fictitious contractor.
Before a prompt is sent to our model provider, the company identifiers we hold for your account (company name, UEI, CAGE code, DUNS and contract numbers) and the contact details we detect by pattern (email addresses, phone numbers, tax identifiers and card numbers) are replaced with placeholder tokens. The real values are restored in the result shown to you.
Data is encrypted in transit. Sensitive stored data, including saved incurred cost proposals, connected-account tokens and the token map of each AI run, is encrypted at rest with AES-256-GCM and bound to your account. Passwords are stored only as salted hashes.
Every request is checked on the server against your verified session and plan, and the records you create are scoped to your account. Sign-in is protected by account lockout after repeated failed attempts and by sessions that end after a period of inactivity. You can also sign in with Google or Microsoft, which applies your provider's own sign-in protections, such as two-step verification, where your account has them turned on.
Each AI run is recorded in an audit trail whose entries carry a cryptographic signature, so alteration is detectable. Paid plans can view and export their own trail at any time.
We do not use your data to train AI models. Our model provider, OpenAI, states in its API terms that API inputs and outputs are not used to train its models.1
Dependencies are audited and the code base is scanned for secrets on every change, and the platform is assessed internally against a written penetration test plan.
1Section 4 of the Privacy Policy describes AI processing feature by feature, and OpenAI's enterprise privacy commitments carry the provider's current terms.
Try it
Type anything on the user side and name the identifiers the platform would hold for your account. The masking layer runs here in your browser; the text you type is not sent to GovConDash or to any model provider.
Token map for this request
What the model provider would receive
Is the $184,500 retention bonus [[ORG-1]] (UEI [[UEI-1]], CAGE [[CAGE-1]]) paid under contract [[CONTRACT-1]] allowable under FAR 31.205-6? Our CO, [[PERSON-1]], wants the support at [[EMAIL-1]] or [[PHONE-1]].
known identifiers and detected patterns replaced with placeholder tokens
In the platform the identifiers come from your account: the company name as you entered it and as SAM.gov registers it, your UEI, DUNS and CAGE code, the contract numbers on your awards, your own name and the clients on a professional's roster. Email addresses, phone numbers, tax identifiers, Social Security numbers and card numbers are found by their shape. A name the layer was not given and that matches no pattern is left as it is, which is what you will see if you type one above.
Cloudflare's edge networkOur servers and database are in the United States. Some service providers we use, such as our AI model provider and payment processor, may process data in other countries. The Privacy Policy lists them in Section 5 and describes where data is processed in Section 11.
Built and hosted inGovConDashHow GovConDash handles your data, the AI models it uses, and what is available for your review.
Your account and company profile, the files you upload, your saved proposals and Workspace documents, and the prompts you write and the results you receive. The public records the platform reads, such as regulations, decisions and award data, are not customer data.
Data is encrypted in transit, sensitive stored data is encrypted at rest, access is checked on the server on every request, and we do not use your data to train AI models. No system is perfectly secure; the Privacy Policy describes the measures we use and how we would notify you of a breach affecting your personal information.
In the United States, on infrastructure we operate, reached through Cloudflare's edge network. Backups are encrypted.
Your prompt, the relevant parts of your company profile, the file or document you chose for that run and passages of public text, after the identifiers we hold for your account and the contact details we detect by pattern have been replaced with placeholder tokens. The provider is OpenAI, through its API. Section 4 of the Privacy Policy describes this feature by feature.
We do not use your data to train AI models, and OpenAI's API terms state that API inputs and outputs are not used to train its models.
Automated dependency audits and secret scanning run on every code change, and the platform is assessed internally against a written penetration test plan. We do not yet hold a third-party certification.
Continue with Google
Continue with Microsoft