- Product: InProQu
- Last updated: 31 July 2026
This page describes how InProQu protects customer data and how AI features handle your content. It is a plain-language summary of practices in the product today — not a certification badge and not a substitute for our Privacy Policy or Data Processing Addendum.
Google API Limited Use
InProQu’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Google user data is used only to provide or improve user-facing features you enable (such as Sheets export, Drive file save, Calendar events, Gmail send, or Contacts import). We do not sell Google user data, use it for advertising, or use it to train generalized AI/ML models. OAuth tokens are encrypted at rest and removed when you disconnect the integration. Full details: Privacy Policy — Google API services and Limited Use.
How we protect your workspace
- Accounts and access — Passwords are hashed (bcrypt). Optional MFA (TOTP) is available; workspaces can require it. Sessions use httpOnly cookies with idle timeout. Failed logins are rate-limited and locked after repeated failures.
- Multi-tenant isolation — Documents, clients, and files are scoped to your workspace. Authorization is checked on server actions and APIs so one tenant cannot read another’s data by guessing IDs.
- Encryption — Sensitive fields (including many client and document payloads) are encrypted at rest with application-level encryption keys. Share links use high-entropy tokens and can expire or be disabled.
- Input safety — Mutations are validated (Zod). Rich text and HTML are sanitized before storage and display. Uploads are size- and type-checked.
- Auditability — Sensitive actions (share, access changes, security events) are written to audit logs for workspace operators.
- Transport — Production deployments use HTTPS and security headers (including CSP and HSTS where configured).
No product is perfectly secure. Report suspected vulnerabilities to your platform support contact.
Artificial intelligence and data use
InProQu’s AI features (drafting, editing, chat) use your connected AI provider (for example Claude, ChatGPT, or Gemini) with credentials you configure under Integrations.
- Bring your own key (BYOK) — Prompts and relevant document context are sent to the provider you chose, under that provider’s terms. InProQu does not run a separate “training” pipeline on your proposal content.
- Scoped to the request — Content is used to fulfill the drafting or editing action you started (and optional knowledge you attach). It is not shared across other customers’ workspaces.
- Knowledge and attachments — When you ground AI on your knowledge library or attach a reference file, only retrieved/selected material for that request is included in the model call.
- Your controls — Disconnect the integration or avoid AI features if you do not want content sent to a third-party model. Review each provider’s data policies for retention and training.
InProQu does not claim that AI providers never retain logs; that is governed by your agreement with them. Prefer enterprise/API plans from providers when you need stricter data-use commitments.
What we do not claim here
Unless separately published with auditor reports, InProQu does not assert:
- SOC 2 / ISO 27001 certification
- HIPAA certification or a general BAA offering
- Qualified electronic signatures (eIDAS QES)
- Blanket “GDPR certified” marketing badges
We do provide GDPR/CCPA-oriented privacy documentation and a Data Processing Addendum for customers who need processor terms — see Privacy, DPA, and Subprocessors.