Security and privacy
What we store, who can see it and how we protect it, in short. The full detail is in our privacy policy.
What we store
- Your work email, and your name if you give it.
- Your firm's region (one per account) and the people you invite to the account.
- Your plan, trial dates and sign-in records.
- The Stripe customer and subscription IDs for your plan. Never your card number.
- What you send us: "Wrong record?" reports, feedback, call requests and emails.
- A copy of each email we send you, and clicks on record links in them.
- How the site and app are used (analytics and session replay, below).
What we record on the site
We use PostHog to record how people use the site and the app: pages, clicks, errors and session replay. A replay is a recording of the page as you used it, including what you type into ordinary fields such as a ZIP code or an email address. Passwords, sign-in codes, card fields and other secret fields are masked in your browser before anything is sent. We use this to find what's confusing or broken and fix it.
Who sees which regions I follow?
No other customer. People you invite to your firm's account see its region and its list. Our team can see it to run the service and to answer you.
Do you sell my data?
No. We don't sell or rent personal data, and we don't use it for advertising.
Where it runs
- This website and the app: Fly.io, in its Ashburn, Virginia region (US).
- Database and API (your account, region, reports and messages): Convex, on AWS US East (N. Virginia).
- The weekly data run that reads the state records: Fly.io, Ashburn, Virginia.
- Email to you: Amazon SES, AWS US East (N. Virginia).
- Analytics and session replay: PostHog's EU cloud.
- Payments: Stripe. Card details go to Stripe, never to us.
These providers handle data for us. Each name links to its privacy policy.
| Provider | What we use it for | What it handles | Where |
|---|---|---|---|
| Fly.io privacy policy | Hosting for this website, the app and our weekly data run | Web requests: IP address, browser, the page asked for | US: Ashburn, Virginia (Fly.io region iad) |
| Convex privacy policy | Database and API for the app | Your account, region, the emails you give us, reports and messages | US: AWS US East (N. Virginia) |
| Amazon SES privacy policy | Sending our emails to you | Your email address and the email we send you | US: AWS US East (N. Virginia) |
| Resend privacy policy | Alerts to our team when you sign up, report a record, send feedback or ask for a call | Your email address and what you sent us | US (Resend's us-east-1 region) |
| PostHog privacy policy | Product analytics and session replay | Pages viewed, clicks, session recordings (secret fields masked), browser details, IP address | EU (PostHog EU cloud) |
| Stripe privacy policy | Payments | Your card and billing details (entered with Stripe, never with us), your email and plan | See its privacy policy |
How we protect it
- Encrypted connections (HTTPS) everywhere. This site and the app tell browsers to use only HTTPS.
- No passwords to leak. You sign in with a one-time code sent to your email. We store sign-in codes and session tokens only as hashes, codes expire quickly, and wrong guesses are limited.
- Card details go straight to Stripe. We never see or store your card number.
- Public endpoints are rate-limited to stop abuse.
- This website is static pages with a strict Content Security Policy. It holds no account data.
- A weekly data update goes live only after it passes our test gate. A failed or partial update never shows.
- Admin access to account data is limited to our team.
Can I use this in a qualifications-based selection?
Texas law has a public owner choose its architect on qualifications first, and only then negotiate the fee. Section 2254.004(a) of the Texas Government Code says:
"In procuring architectural, engineering, or land surveying services, a governmental entity shall: (1) first select the most highly qualified provider of those services on the basis of demonstrated competence and qualifications; and (2) then attempt to negotiate with that provider a contract at a fair and reasonable price."
The same chapter bars selecting these services "on the basis of competitive bids" (§2254.003). Its "governmental entity" includes "a district, authority, county, municipality, or other political subdivision of the state" (§2254.002). Read chapter 2254 on the Texas Legislature's statutes site.
bondpassed doesn't change any of that. It shows public records: the building projects public owners near you registered with the state, the design firm named on each, the design firms on an owner's earlier TABS projects where we've read its history, and the bonds on its ballot. Use it to know your market and prepare your qualifications.
It doesn't tell you whom to contact or when. Each owner's solicitation sets its own rules: check each RFQ and follow it.
This is general information, not legal advice.
Is this official?
No. bondpassed is not affiliated with or endorsed by the State of Texas, TDLR, the Texas Bond Review Board or TBAE. We read their public records and link to each one.
Report a security problem
If you find a security problem, email us. We'll reply, fix what's real and tell you when it's done.
- hello@bondpassed.com
- Helios One
3075 Clay St
San Francisco, CA 94115