Stated plainly: customer data is never used to train Pursuit's models, and never used to train any third-party foundation model. Pursuit does not train cross-customer models or customer-specific models, and models are not shared between customers.

‍

Signal extraction

Natural-language and LLM pipelines extract early buying signals from agendas, budgets, minutes and procurement notices

‍

Entity resolution

Probabilistic matching verifies and enriches public-sector contact records

‍

Providers

Anthropic, OpenAI (including via Microsoft Azure OpenAI Service), and Google, each contracted as a subprocessor on terms prohibiting training on submitted data, assessed before onboarding and annually thereafter

‍

What is sent

Publicly available and FOIA-obtained public-sector documents and text

‍

Prompt retention

Prompts and outputs retained 30 days, then purged, unless extended for a specific support investigation

‍

Oversight

Nightly automated evaluation against verified ground truth with drift alerts, input validation and outlier detection, in-product human override with a feedback loop, and a source reference behind every model output

‍

Security testing

AI components assessed against the OWASP Top 10 for Large Language Model Applications; all AI operations emit structured logs to CloudWatch

‍

Not used for

No decisions about an individual's health, legal or financial position, employment, or access to essential services

Report

SOC 2 Type 2, Security trust services category

‍

Period

September 1, 2025 through August 31, 2026 — a full twelve-month examination period

‍

Auditor

Insight Compliance LLC, dba Insight Assurance — Tampa, Florida

‍

Opinion

Unqualified — the system description was fairly presented, controls suitably designed, and controls operated effectively throughout the period

‍

Currency

Coverage since the examination period is carried by an active management bridge letter, issued with the report. A bridge letter is management's representation, not an auditor's report

‍

Subservice orgs

AWS and MongoDB, carved out for physical and environmental controls over hosting facilities

‍

Risk program

Annual comprehensive risk assessment, a maintained risk register scored by likelihood and impact, assigned risk owners, remediation tracked to closure

‍

Request the full report under NDA →

Legal entity

Pursuit Markets, Inc. — a privately held corporation

‍

Established

October 2023

‍

Headquarters

112 S Main Street, Suite B, Ann Arbor, Michigan 48104, United States

‍

Business model

Software-as-a-Service, sold by seat with an annual platform fee

‍

System of record

“AI-powered Opportunity Intelligence Platform” — the system named in Pursuit's SOC 2 Type 2 report

‍

Delivery model

Multi-tenant SaaS with logical tenant isolation. Pursuit operates no physical data centers and uses no private cloud

‍

Access methods

Web application, Chrome extension, bidirectional Salesforce and HubSpot integrations, CSV export, and — for provisioned customers — a GraphQL API and MCP endpoint

‍

Primary contact

Mike Vichich, Chief Executive Officer

‍

Security officer

Brandon Max, Co-founder & Chief Technology Officer — serves as both Security Officer and Privacy Officer

MSA

Pursuit's standard Master Services Agreement is published and available in editable form for redline. Term and renewal are set on each Order Form

‍

Privacy terms

The US Privacy Law Addendum is Pursuit's data processing agreement, covering categories of personal data, prohibition on sale or sharing, subprocessor notice and objection rights, breach notification, and return or deletion on termination

‍

Mutual NDA

Pursuit maintains a standard mutual NDA and will execute your form. Required before release of the SOC 2 report, penetration test results and policy documentation

‍

Right to audit

On written request at reasonable intervals, no more than once per calendar year, at your cost

‍

Insurance

Cyber liability, technology errors and omissions, and commercial general liability coverage is maintained. Certificates naming your organization are issued on request

Available to your administrators

Single sign-on

SAML 2.0 and OIDC, tested with Okta, Microsoft Entra ID and Google

‍

MFA

Enforced through your identity provider; configurable password policy for any non-SSO users

‍

RBAC

Granular, with built-in Admin and User roles

‍

Revocation

One-click revocation of sessions and API tokens

‍

Audit trail

Logins and SSO events, MFA challenges, role and permission changes, exports and imports, API calls, integration syncs and system errors, all viewable and filterable in-app

‍

Export scoping

Administrators select which objects, fields and record filters are in scope; personal-data fields can be excluded. API rate limiting applies

‍

‍

Pursuit personnel access

Standing access

None. Employees have no standing administrative access to production customer data; access is disabled by default

‍

Granting access

Time-bound, ticketed grants to named Support and SRE staff only, approved case by case by the security team for a specific support purpose

‍

Authentication

Okta SSO with MFA (FIDO2/WebAuthn or TOTP) for production, console and VPN access. SSH root login disabled; admin ports restricted to authorized IP ranges

‍

Access reviews

Formal recertification annually, tested without exception in the SOC 2 examination, plus quarterly automated IAM and Okta least-privilege audits

‍

Deprovisioning

Infrastructure and code-review access removed within one business day of termination; orphaned rights removed within 24 hours

‍

Secrets

Credentials, API keys and certificates held in AWS Secrets Manager and rotated every 90 days; never hard-coded

Perimeter

Default deny-all inbound and outbound; unauthenticated inbound blocked. Security Groups and Network ACLs enforce least functionality; ingress is HTTPS only

‍

Protective controls

AWS WAF with OWASP Top 10 rule coverage, AWS Shield for DDoS, GuardDuty for threat and intrusion detection, and API rate limiting

‍

Firewall governance

Rulesets reviewed annually, unnecessary rules removed, administrative access logged. Every service, protocol and port is documented and business-justified

‍

Endpoints

Company-issued laptops with full-disk encryption, anti-malware with daily updates, automated patching, host firewalls and CIS-benchmark hardening; users cannot disable protection

‍

Key management

AWS KMS with separation of duties between key-use and key-administration roles. Keys rotated at least every 12 months and never reused after retirement

‍

Logging

Authentication, administrative actions, access-rights changes, sensitive-data access and exports, network connections, and access to the logs themselves — with actor, object, outcome and NTP-synchronized timestamps

‍

Log integrity

Backed up to a central log server outside administrator control; administrators cannot erase logs of their own activity, and file-integrity monitoring alerts on tampering

‍

Log retention

Nine months in hot storage; security documentation and audit trails for a minimum of seven years

‍

Monitoring

24×7. Metrics, logs, IDS and endpoint detection feed CloudWatch, with CISA advisories and AWS security feeds as threat intelligence. Alerts route to the on-call Information Security Manager

‍

Remediation

Critical 48–72 hours · High 3 days · Medium 7 days · Low best effort. No release with an unresolved Critical or High finding without documented approval from both the Security Officer and the asset owner

‍

Secure development

Pull requests with branch protection, peer review by someone other than the author, static analysis in CI, Terraform infrastructure-as-code, and CTO approval before production promotion

‍

Test data

Production data is never used in testing or development — synthetic or tokenized data only. Test accounts and default credentials are removed before release

Screening

All employees and contractors complete a Checkr background check before start date — identity, criminal history, watch-list and education verification

‍

Agreements

Confidentiality and non-disclosure agreements signed before access to confidential information, re-acknowledged annually alongside the Information Security Policy, Code of Conduct and Acceptable Use Policy

‍

Training

Security awareness training within 30 days of hire and annually thereafter, tracked through Drata, plus quarterly phishing simulations and role-based training for engineering, DevOps and support

‍

Due diligence

Security questionnaires, compliance reports and shared-responsibility analysis before engagement. No vendor accesses Pursuit assets before a security and privacy contract is signed

‍

Ongoing review

SOC 2, ISO or equivalent evidence reviewed annually for critical vendors, recorded in the vendor inventory and risk register. Vendors are tiered High, Moderate or Low

‍

Third-party access

Provisioned through SSO with least privilege, logged, reviewed quarterly, enabled only for the authorized window, and revoked at contract end

‍

Change notice

Any new subprocessor is added to the list and customers are notified by email at least ten days before it is enabled, with a ten-day objection window

‍

Residency

All subprocessors are United States entities that store and process data within the United States

‍

Request the complete subprocessor list →

Backups

Automated daily full backups of MongoDB Atlas and Amazon RDS, plus continuous point-in-time snapshots at 60-minute intervals. Infrastructure configuration is version-controlled as code

‍

Protection

AES-256 via AWS KMS, replicated cross-region within the United States, access restricted to key personnel. Retained 35 days

‍

Recovery objectives

Stated RTO and RPO of 24 hours, with the DR plan targeting full restoration within 24 hours. Underlying capability is materially tighter — point-in-time recovery at 60-minute granularity

‍

Testing

Restoration testing verifies recovery capability; BC and DR plans are tested at least annually with documented results and lessons tracked to closure

‍

Internal reporting

Any employee or contractor must report a suspected vulnerability or incident to the Security Officer within 24 hours; failure to report is a security violation

‍

Investigation

Preliminary investigation and risk assessment within 48 hours, severity assigned High, Medium or Low, with root cause, evidence and mitigations documented

‍

Your notification

Operating practice is notification within 24 hours of confirming an incident that affects your data or systems, with details and mitigation steps. The contractual standard is without undue delay

‍

Closure

Post-incident review with root cause analysis and documented lessons learned. Every incident is logged with disclosures recorded

‍

Testing & training

The incident response plan is tested annually and all staff are trained on the procedure at least annually

‍

Track record

The SOC 2 report states that no significant system incidents occurred during the twelve-month examination period, and the current bridge letter confirms management is aware of none since

Collected by Pursuit

Public-sector entity master data, public documents, agendas, minutes, budgets, procurement notices, contract records, FOIA responses, and professional contact records for public-sector personnel

‍

Provided by you

Only the CRM objects you choose to sync, SSO identity data, and usage and audit events. You select which objects, fields and record filters are in scope; personal-data fields can be excluded

‍

Never collected

Social Security or national ID numbers, driver's license numbers, payment card or bank account data, health records, biometric identifiers, precise geolocation, or personal non-work contact details

‍

Residency

AWS us-east-2 (Ohio) with encrypted backups to us-west-2 (Oregon). All data stays within United States borders at rest, in processing, and in backup

‍

Tenant isolation

Multi-tenant with logical separation by unique customer identifier, enforced at the API layer — the account identifier is embedded in the access token and every datastore query is scoped by it. No commingling of customer data

‍

Retention

Retained while the account is active. On closure the account expires and data is permanently removed 30 days later, except where law requires retention. A record of deletion is kept

‍

Data return

CSV export, Salesforce or HubSpot sync, or an encrypted snapshot on request. On termination Pursuit returns or deletes personal data at your election

‍

No sale or sharing

Under the US Privacy Law Addendum, Pursuit will not sell or share your personal data, or use it outside the direct business relationship

Pursuit's SOC 2 report identifies complementary user entity controls — the controls your organization must operate for the overall control environment to work as designed. Your auditors will look for these.

‍

User access

Maintain controls providing reasonable assurance that user access, including provisioning and deprovisioning, is appropriately designed and operating effectively — in practice, prompt removal of departing users from your Pursuit tenant and correct identity-provider configuration

‍

Issue reporting

Report issues with Pursuit systems and the platform through the support channels provided

‍

Contractual

Understand and comply with your contractual obligations to Pursuit

‍

Contact changes

Notify Pursuit of changes to administrative contact information, so security and incident communications reach the right people

‍

Subservice orgs

Physical and environmental security of the hosting facilities, and destruction of physical assets, are the responsibility of AWS and MongoDB as subservice organizations. Their controls were not examined in Pursuit's SOC 2 report and are covered by those providers' own attestations