Security claims are vague
Buyers need concrete controls and boundaries, not a generic secure-by-design badge.
Security and deployment
Know where RFQ data lives and which controls are actually present.
RapidRFQ security and deployment facts: local data, authentication, signed portals, upload validation, backups, integration boundaries, and assurance limits.
Deployment diligence
Local-first still requires clear operational controls.
Local data is still operational data
A shop-owned installation still needs strong secrets, patching, backups, access control, and recovery drills.
Compliance is not a feature flag
CMMC, ITAR, SOC 2, and similar programs require organizational and operational evidence beyond application code.
01 / 03
Application controls
Estimator access uses local accounts and roles. Browser login uses an HttpOnly, SameSite=Strict session cookie, while public write routes are rate limited.
CAD and PDF uploads have size limits and content-signature validation. Supplier and customer portals use expiring, scoped tokens tied to the relevant RFQ and quote state.
- Local users and roles
- Server-held sessions
- Rate limiting
- File validation
02 / 03
Data and recovery boundary
SQLite data, uploaded RFQ files, configuration, and backups remain under the local data directory. Backups can be validated before restore, and restore uses a pre-restore safety backup.
Administrators remain responsible for host security, encrypted disks where required, operating-system updates, network exposure, off-machine backup copies, and tested recovery appropriate to their customer obligations.
- Local database and uploads
- Validated backup archives
- Restore safety copy
- Operator-owned host controls
03 / 03
What RapidRFQ does not claim
Local-first architecture is not itself a compliance certification. RapidRFQ does not currently claim SOC 2, CMMC assessment, FedRAMP authorization, guaranteed uptime, managed disaster recovery, or universal malware scanning.
Pilot qualification should document deployment topology, users, secrets, backup and restore evidence, external routes, catalog credentials, support responsibilities, and any customer-specific security requirements before live RFQs are introduced.
- No implied certification
- No blanket ITAR claim
- Pilot security checklist
- Customer-specific review
Straight answers
What local-first security does not solve by itself.
Can RapidRFQ be exposed to the internet?
Selected public portals can be reverse-proxied through a controlled hostname. The estimator workspace should remain authenticated and deployment should be reviewed for the target environment.
Are backups included?
Yes. The application includes local backup creation, validation, download, and guarded restore workflows.
Is RapidRFQ CMMC compliant?
No certification is claimed. Compliance depends on the complete technical and operational environment and independent evidence.
Qualify the environment
Review the controls before customer files arrive.
Document the host, identities, secrets, public routes, backups, recovery, patching, and customer-specific obligations.