SourceFlag

Public files only. Human review required.

SourceFlag is for public and unclassified solicitation review with citations and clear upload boundaries.

Public files only. Human review required.

Use SourceFlag for public/unclassified solicitation materials. Verify AI-assisted output before use.

Read Trust Center

Source-backed outputs

Citations and excerpts stay close to important answers.

Do-not-upload boundary

Do not upload restricted, controlled, private, or sensitive material.

Human review required

Proposal, pricing, legal, and compliance decisions stay human.

Workspace access

Access follows account roles, memberships, and invitations.

Review public solicitations without mixing in restricted material.

Organize public and unclassified solicitation packages into a source-backed workspace for first-pass proposal review.

Public RFP review checklist for proposal teams.

Use this public RFP review checklist to organize intake, requirements, deadlines, risks, clarifying questions, kickoff, and handoff.

Federal Contract Information (FCI) and SourceFlag boundary.

Federal Contract Information is information not intended for public release that is provided by or generated for the government under a contract.

Who operates SourceFlag?

SourceFlag is operated by CodeArtisans LLC and is scoped to U.S.-only B2B use with public and unclassified solicitation materials.

Read About SourceFlag

Self-serve scope

Current self-serve plans are U.S.-only, B2B-only, and limited to public/unclassified solicitation packages.

Public and unclassified boundary

SourceFlag is intended for public solicitation packages and related public attachments only.

Source-backed outputs

Ask answers and review outputs are designed to stay tied to source files, citations, excerpts, pages, and attachment references.

Human review required

SourceFlag accelerates first-pass review, but it does not guarantee compliance or replace proposal-team judgment.

Workspace access controls

Workspaces are intended to separate access by account, membership, invitation, and role flow.

AI processing posture

SourceFlag uses managed AI providers for product features such as review, Ask, drafting, summarization, and extraction.

Data export and deletion

Workspace data can be exported or deleted on verified request where commercially reasonable.

What SourceFlag is not

No unsupported compliance or security promises.

The trust posture is intentionally conservative. SourceFlag supports review; it does not become the authority on agency interpretation, compliance, or proposal risk.

No SOC 2 report is currently offered.
No FedRAMP authorization is currently offered.
No CMMC certification is currently offered.
Not a CUI, Federal Contract Information (FCI), ITAR, classified, or export-controlled hosting environment.
Not legal, procurement, pricing, capture, compliance, security, or export-control advice.
Not a guarantee that every requirement, deadline, risk, ambiguity, amendment, or instruction will be found.

Security practices

SourceFlag uses commercially reasonable administrative, technical, and organizational safeguards designed to protect information. No transmission, storage, or processing method is perfectly secure.

Users are responsible for deciding what to upload, managing access, keeping credentials secure, and verifying outputs before use.

Subprocessors and service providers

The current Privacy Policy names these providers for AI processing, authentication, database/storage, hosting, background jobs, billing, business email, and optional walkthrough video embeds:

OpenAI APISupabaseStripeVercelRenderGoogle WorkspaceYouTube privacy-enhanced embeds
View subprocessors and service providers

Trust and security questions, answered.

The answers stay aligned with the public/unclassified boundary, Privacy Policy, and Terms.

Need to report a privacy or security concern?

Use the published Privacy contact for privacy requests, security concerns, and data-handling questions.

Contact privacy@sourceflagworkspace.com