Privacy

Account data includes your email address, login name, authentication sessions and sign-in tokens, subscription identifiers, API keys, and settings. Monitoring data includes the entities and labels you submit and their monitoring history. Verification records and audit packets preserve the queries, entity identities, roster contents, results, source dates, and seals needed to reproduce their evidence chain. Historical audit packets through packet-result version 5 retain the account's login name and email sealed at issuance. New packets use packet-result version 6 and omit that automatic account attribution.

Security and operations data can include IP addresses, request timestamps, user agents, rate-limit counters, and error logs. Public contractor and award data comes from the government sources named on each page or record.

We use information to authenticate accounts, run checks, maintain monitored entity lists, create records and packets, send requested service email, process billing, prevent abuse, diagnose failures, and improve reliability.

We do not sell personal information or use third-party advertising trackers.

We use PostHog to understand page visits, navigation, and use of public browsing pages. It may process IP addresses, device and session identifiers, browser information, referring sites, permitted interactions, and session recordings. This is product analytics, not advertising tracking.

Account, monitoring, checkout, exclusion-check, and evidence pages send only generalized pageviews. Their exact record identifiers, URL query values, and page contents are excluded. Session recording stops for the rest of the loaded document after visiting one of these pages. Account menus, exclusion-check controls and results, and registry-search controls and results are excluded from interaction capture and session recordings, including on the homepage.

Separate first-party funnel counters retain aggregated daily totals. They are not sent to PostHog.

Verification records and audit packets are the deliverable, and access to them works by unguessable link, not by signing in to your account. Anyone who has a record or packet link can read it: the query, the entity identity, any candidate information, the roster contents an audit packet covers, the dated source facts, and any account identity sealed into a historical packet. Treat issuing a record or packet as publication, not as a private save.

Links do not expire when service ends. Sharing a link shares the sealed evidence, and anyone you give it to can pass it on. Pages ask search engines not to index records and packets, but a link you share cannot be unshared.

Information is shared only as needed with infrastructure and service providers that support hosting, email delivery, billing, bot protection, product analytics, and off-box backups. Stripe receives billing information. Cloudflare Turnstile receives the browser and network information required to assess a free-check request.

Public source queries may send the entity name, UEI, or CAGE needed to retrieve the requested government data.

Permanent evidence. Verification records, audit packets, their source references, signatures, timestamps, and attachments are retained permanently because permanence is part of the requested service. Historical packets retain any account identity sealed into their original bytes. Neither a later policy date nor account deletion rewrites those bytes. Packet-result version 6 omits automatic login identity from newly issued packets.

Account-owned operational data. Sessions, sign-in tokens, monitored entity lists, monitoring history, alert state, API keys, settings, billing linkage, and queued notices are retained as needed to provide and protect the service and meet applicable obligations.

Recovery copies. Independent of the permanent evidence, recovery copies of the operational database are retained as full snapshots for up to seven daily, eight weekly, and twelve monthly generations, and as a separate 30 day point-in-time replication history. A deletion takes effect in the live database when it is performed and reappears in a copy only if that older copy is restored; before a restored copy returns to service, completed deletions are reapplied to it.

To request deletion, email privacy@federal.contractors from the account's login address. We verify the requester through that address, and billing obligations and any subscription are canceled or settled with the account holder's authorization before removal proceeds.

A completed deletion revokes access immediately by removing sessions and outstanding sign-in tokens, and removes the account-owned operational data listed under Retention, including queued future email. Removal is completed within 30 days of a verified request.

Sealed records and packets the account issued are kept, detached from the account, because a permanent record that disappears when an account closes would not be a record. We do not claim to erase issued evidence: the account identity already sealed in previously issued packets remains readable in them, and retained recovery copies expire on the schedule above rather than on request. Stripe retains billing records under its own terms.

We use access controls, hashed API keys, encrypted transport, restricted production credentials, rate limits, and off-box backups. No system can guarantee absolute security.

You can stop monitoring entities, revoke API keys, change subscription settings, and stop service email by ending the related service or subscription. Sealed records and packets remain where permanence requires it.

This notice may be updated as the service or its providers change. Material updates will be identified by a new effective date on this page.

federal.contractors is operated in the United States as a sole proprietorship doing business as federal.contractors. Privacy questions and deletion requests: privacy@federal.contractors. General support: support@federal.contractors.