What we store, where it lives, and how it's protected — stated plainly, without certifications we don't hold.
Last updated: October 24, 2026
Almost everything GovFabric shows is public federal data — SAM.gov registrations and opportunities, USAspending awards, agency procurement forecasts, and federal and state exclusion lists.
For your account we store only what the product needs: your company profile (company name, UEI, state, NAICS codes and certifications), the opportunities you save to your pipeline, your alert and email preferences, API key records, and your subscription status. We don't store passwords or card numbers.
The application runs on Google's Firebase App Hosting. Data is stored in a managed Neon Postgres database. Application secrets (database credentials, API keys for our providers) are kept in the hosting platform's secret manager, not in our code.
The site is served only over HTTPS, and the application connects to its database over TLS (connections that can't negotiate TLS are refused).
Accounts and sign-in are handled by Clerk, a dedicated authentication provider. GovFabric never sees or stores your password. The signed-in app and its data APIs check your session (or API key) on the server before returning anything; only the free public tools — the contractor check and company name lookup — answer without signing in, and they're rate-limited.
Billing runs on Stripe. You enter card details on Stripe's own checkout and billing pages; GovFabric never receives or stores card numbers. We keep only the Stripe customer and subscription identifiers needed to know which plan you're on.
API keys are shown to you once, when created. We store only a one-way SHA-256 hash of each key (plus a short prefix so you can tell keys apart), so a key can't be recovered from our database. You can revoke a key at any time.
To export or delete your account data, email privacy@govfabric.com. Cancelling a subscription doesn't delete your account; ask and we will.
If you believe you've found a security issue, please email privacy@govfabric.com with the details and steps to reproduce. Please don't access other users' data or degrade the service while testing. We'll acknowledge your report and keep you updated while we fix it.
GovFabric is not SOC 2 audited and is not FedRAMP authorized. It is a commercial service for researching public procurement data and is not intended for classified or controlled unclassified information (CUI).
We pull your SAM registration, fill in your NAICS codes and certifications, and show the open opportunities, recompetes and competitors in your market.
Start free — no credit card