Your clients' data stays yours.
Proposals are built from counts, never records about people, in a sandbox that can't reach the internet. Your team decides what the client sees, and who can read it.
- Identifying data is refused at the door
- Every build runs in a sandbox with no network
- Nothing goes out without your approval
- Readers can verify their email first
Nothing reaches your client until your team approves it.
The public link stays dark until a version is approved, and a new version waits for review while the client keeps reading the last one.
We take counts, and turn away a row per person.
A proposal needs to know that 318 people live in Ohio, not who they are. Requests that carry names, birth dates, member IDs or a per-person list are rejected before anything is read, and groups too small to stay anonymous arrive blank.
The controls your team keeps.
- Builds run in an isolated sandbox with no network, deleted within the hour.
- Readers can be asked to verify their email with a one-time code.
- Every reader is named, so you know who opened it after a forward.
- Proposals live on your domain, with your brand on reader emails.
- A proposal can be withdrawn at any time, and its link goes dark.
- Review comments are checked for identifying data too.
What security reviewers ask us.
Send us your questionnaire and we'll answer it in writing: bob@unfairly.ai.
What data do you need from us?
Totals: headcount, how many people live in each state or region, rates and plan details. Never a list of people. If a request includes names, birth dates, member or employee IDs, or a row per person, it's rejected before it's read.
What happens to small groups?
Your template sets a floor for sensitive counts. A group above zero but below that floor has to arrive blank, so a count of two can't point at anyone.
Where is a proposal built?
In a sandbox with all network access blocked. It stops itself after 15 minutes, is deleted within the hour, and is deleted as soon as the build finishes.
Who can read a proposal?
Whoever has the link, or only readers who enter an email you've allowed and confirm it with a one-time code. Every reader shows up by name in the reading report.
Can we pull a proposal back?
Yes. Withdrawing a proposal takes its live link down at once. Drafts and new versions are only ever visible to your team until someone approves them.
Can it run on our domain?
Yes. Proposals can live at an address like proposals.yourcompany.com, and the emails readers get come from your company's name.