Data and privacy
Where the data comes from
| Source | What it is |
|---|---|
| RFPs and solicitations | Indexed from agency procurement pages and bid aggregators |
| Civic signals | Extracted from council and board meeting minutes |
| Vendor spend | Government purchase records |
| Contracts | Public contract and purchase order records |
| Contacts | Agency staff directories |
The same solicitation often appears on several sites, so results are de-duplicated to one row per agency, title and deadline.
Signals are drawn from meeting minutes rather than published solicitations, which is why they surface earlier than an RFP does.
Coverage is SLED only: more than 100,000 US state, local and education agencies. Federal procurement is not included.
What the connection can change
Civic IQ MCP is read-only apart from three tools:
| Tool | What it changes |
|---|---|
create_alert | Saves a recurring search on your account |
delete_alert | Removes one |
launch_sequence | Sends real email from your connected mailbox |
These are marked as write actions in the protocol, so Claude and ChatGPT can ask you before running them. Nothing else writes anything.
Your own permissions apply. The connection acts as your Civic IQ account. State coverage, plan limits and workspace access carry over unchanged, so an assistant cannot reach anything you could not reach yourself.
Source links expire
Document links returned with signals and RFPs, both the PDF and the markdown version, are time-limited. A link that worked yesterday may not work tomorrow. Run the search again to get a fresh one.
What is logged when you use it
Your query arguments are logged with your account identifier. Those logs are kept for 30 days and then deleted automatically. They are encrypted at rest, and access to them is role-controlled.
Product analytics run through PostHog, in its US region, recording tool-call events attributed to your account. One field in those events is populated by your assistant with a short description of what you were trying to do, so the assistant's summary of your intent is recorded alongside the call.
What does not happen
No language model sits in the request path. When your assistant searches Civic IQ, the search goes to the index. Your query is not passed through a model on our side.
No customer data is used for model training.
Nothing is silently corrected. A record that contradicts itself, such as an RFP marked open whose deadline has passed, is flagged with a data_quality_warning rather than quietly fixed or dropped.
Attribution
Answers built on Civic IQ data are credited as "Source: Civic IQ". The first prompt in the quickstart asks your assistant to do this from the start.
About API keys
An API key grants access to your Civic IQ account, so treat it like a password.
A key can be sent in an Authorization header, an X-API-Key header, or in the URL path. Prefer a header. A key in the URL travels as part of the address, which means it can end up in server logs, browser history and screenshots without anyone intending it to.
Signing in through your assistant avoids the problem, since nothing durable is written down. Use API keys only where a browser sign-in is impossible, such as a script or a scheduled job. See Connect other clients.
Setup should only take a few minutes. If you have any questions along the way, just reach out at [email protected] and we'll help you get connected.