Security at SunriseBids

Last updated: to be published

SunriseBids is a small, independent service. We collect as little personal data as we can and protect what we keep. This page explains how, without overstating it. We do not hold certifications such as SOC 2 or ISO 27001.

What we store

We store your email address, the business profile you give us (for example NAICS codes, keywords and set-aside preferences), how you use the service, and your feedback on matches. We do not store passwords, and we never see or store payment card numbers. Payments are handled entirely by Paddle, our Merchant of Record. Opportunity data comes from SAM.gov's public data. See the Privacy Policy for details.

How we protect it

Sign-in

• Passwordless sign-in with single-use email links. Links expire after 15 minutes and are stored only as hashes.
• Session cookies are HttpOnly, Secure and SameSite=Lax.
• Sign-in and sign-up are rate-limited and protected by bot checks (Cloudflare Turnstile).

Data protection

• All traffic uses HTTPS, with HSTS.
• Data is stored on Cloudflare's infrastructure, which encrypts it at rest.
• Every database query is scoped to your account or team, and we run automated tests that check one customer cannot read another customer's data.
• We collect only the personal data the service needs, and we delete accounts on request (see the Privacy Policy for timelines).

Application security

• Every request is validated. All database queries are parameterized.
• All text from users and from SAM.gov is escaped before display, and we use a strict Content Security Policy and other security headers to reduce cross-site scripting and clickjacking risk. State-changing actions are protected against cross-site request forgery.
• SAM.gov notice text is treated as untrusted. When it is sent to our AI provider, it is handled as data, never as instructions, and AI output cannot trigger account actions.

Payments

• Paddle hosts checkout. Subscription status changes only come from Paddle webhooks that we verify by signature, never from your browser.

Infrastructure and process

• Secrets live in managed secret stores, never in source code. Automated secret scanning runs on every change.
• Dependencies are pinned and kept minimal. Automated vulnerability checks run on every change.
• Every release gets a security review before deployment, and serious findings block the release.
• API keys (on plans that include them) are stored hashed and shown to you only once.

Service providers We rely on a small set of established providers: Cloudflare (hosting, database, security), Resend (email), Paddle (payments), Anthropic (AI summaries and ranking), and GitHub (source code and automated jobs). Each receives only the data it needs. See the Privacy Policy.

What you can do

• Keep your email account secure (use a strong password and two-factor authentication there), because sign-in links go to your inbox.
• Do not forward sign-in emails.
• On Team plans, remove members who no longer need access.

If something goes wrong

If we learn of a security incident that affects your personal information, we will investigate, contain it, and notify affected users and authorities as the law requires, without undue delay.

Responsible disclosure

If you believe you have found a security vulnerability in SunriseBids, please tell us at security@sunrisebids.com.

Please include: a description of the issue, the steps to reproduce it, the affected URL or feature, and its likely impact. Screenshots or a short proof of concept help.

What we commit to:

• We will acknowledge your report within 5 business days.
• We will keep you updated while we investigate and fix it, and tell you when it is resolved.
• We will credit you publicly if you want (with your permission).
• We will not take legal action against, or ask law enforcement to investigate, anyone who reports in good faith and follows the rules below.

Rules for testing:

• Test only against your own account, or accounts you have permission to use. Do not access, change or delete other users' data. If you reach someone else's data by accident, stop, and tell us.
• Do not run denial-of-service tests, heavy automated scanning, spam, or social engineering of our providers, and do not test physical security.
• Do not test Paddle, Cloudflare, Resend, Anthropic or GitHub systems themselves. Report issues in their systems to them.
• Give us reasonable time to fix the issue before you disclose it publicly. We suggest 90 days, or sooner once we confirm a fix.

Out of scope: reports from automated scanners with no demonstrated impact, missing best-practice headers with no exploit, clickjacking on pages with no sensitive actions, self-XSS, rate limiting on non-sensitive endpoints, email SPF/DMARC policy suggestions, and issues that require a compromised device or inbox.

We are a small business and do not currently offer paid bug bounties, but we sincerely appreciate good-faith reports.