Data Protection

SAM Submit uses organization-level data isolation, role-based access controls, private file storage, server-side authorization, credential protection, and audited submission activity to help protect your federal contracting workspace.

SAM Submit uses organization-scoped access controls designed to prevent unauthorized access between customer workspaces.

Security controls include:

• Organization-scoped data
• Database Row Level Security
• Server-side membership validation
• Record ownership validation
• Organization-scoped CRM and pursuit data

Access controls are enforced beyond the browser, providing another layer of protection for organization data and privileged actions.

SAM Submit provides role-based access so organizations can assign permissions according to each user's responsibilities.

• Viewer: View permitted workspace information.
• PDF Viewer: View workspace information and access permitted PDF outputs.
• Proposal Viewer: Access permitted proposal and response materials.
• Editor: Create and modify authorized workspace content.
• Admin: Manage the organization's workspace, members, access, and administrative settings.

Privileged actions are validated server-side rather than relying solely on which controls are displayed in the browser.

Protected submission files and packages use private storage and controlled access mechanisms.

SAM Submit provides:

• Private file storage
• Organization and file ownership validation
• Storage-path validation
• Randomized package-sharing links
• Expiring share links
• Short-lived signed download access
• Package access tracking

Shared submission packages use expiring access controls rather than permanent public file URLs.

Sensitive platform and supported integration credentials are handled server-side rather than intentionally exposed in normal browser application state.

This architecture helps protect credentials used for supported AI services, SAM.gov integrations, payment services, infrastructure, and external CRM connections.

SAM Submit does not ask you to provide your Login.gov or CPARS username, password, MFA code, or other Government authentication credentials.

You authenticate directly with the appropriate Government system and use supported import and export workflows where applicable.

No Login.gov password sharing. No CPARS credential collection.

SAM Submit maintains a clear distinction between preparing a response and actually submitting it.

• Prepared: Your response or submission package has been created.
• Portal Opened: You have navigated to the required external Government submission system. Opening the portal alone does not mark the response submitted.
• Transmitted: SAM Submit has successfully transmitted an authorized response through a supported submission method.
• Externally Confirmed: You confirm that a submission was completed through an external Government system.

Failed or suppressed submission emails are not recorded as successful submissions. System-sent email and user-confirmed external filings are also distinguished in the submission history.

Opening a portal is not the same as submitting a response. SAM Submit keeps that distinction explicit.

• Server-Side Authorization: Sensitive actions are checked against authenticated organization membership and permissions on the server.
• Input Validation: Server functions validate expected inputs before processing requests.
• Tenant Ownership Checks: Protected records are checked against the user's organization where applicable.
• Private Storage Controls: Protected files use controlled storage and access mechanisms.
• Credential Protection: Supported integration credentials are protected from unnecessary browser exposure.
• Concurrency Protection: Revision controls help prevent one team member from silently overwriting another team member's newer workspace changes.

SAM Submit includes automated security regression testing designed to identify failures in important application security controls, including:

• Authentication requirements
• Organization isolation
• Permission enforcement
• Protected server functions
• Database access policies
• Package ownership
• Unauthorized write access

SAM Submit maintains records for important application activity where appropriate, including submission receipts, organization activity, administrative actions, package access, usage activity, and response workflow events.

These records help organizations understand what happened, when it happened, and which authorized user performed certain actions.

SAM Submit is designed to handle business, solicitation, proposal, and procurement information while giving organizations control over their workspace and users.

Customers remain responsible for determining whether specific information is appropriate for processing through the service.

Do not use SAM Submit to store or process classified information. Upload CUI, export-controlled information, or other restricted Government information only when SAM Submit expressly states that the applicable service and configuration support that information.

• Least Necessary Access: Access is controlled according to each team member's assigned organizational role.
• Server-Side Enforcement: Important authorization decisions are enforced beyond the browser interface.
• Private by Design: Protected application files use controlled private storage rather than permanent public file URLs.
• Submission Integrity: SAM Submit distinguishes preparation, transmission, external filing, and confirmed submission activity.

SAM Submit combines practical security controls with organization-level access management to help protect the information behind your federal pursuits and responses.

Explore SAM Submit|Contact Us