Security & data handling

• Tenant isolation. Every business record carries an organisation id and is protected by PostgreSQL Row Level Security. Isolation is enforced in the database, not only in the interface, and covered by automated tests.
• Private file storage. Uploads go to a private bucket scoped by organisation. Files are opened only through short-lived signed links after an access check.
• Server-side secrets. The AI provider key and the database service key exist only in server configuration, never in the browser.
• Validated uploads. File type, size and PDF structure are checked before storage; encrypted or corrupt PDFs are rejected.
• Prompt-injection resistance. Text inside uploaded tenders is treated as data. The AI is given no tools, so document text cannot trigger actions; AI output is schema-validated before it is stored.
• Human approval. The product does not submit bids, sign declarations or make payments. Drafts stay marked as drafts until a person approves.
• Abuse limits. Per-user burst limits, daily AI request quotas and monthly analysis quotas.
• Audit trail. Important actions (uploads, analyses, assessments, exports, approvals, membership changes) are recorded. Document text and AI prompts are not written to logs.
• Roles. Owner, admin, member and read-only viewer roles with database-enforced permissions.

To analyse a tender, the extracted text of that tender (and, for eligibility and drafting, the relevant parts of your company profile) is sent from our server to the Anthropic API. Please review Anthropic’s current terms and data-handling commitments for the API at anthropic.com. We send only what a given operation needs.

• Your documents and records are kept until you delete them or delete the workspace.
• Deleting a tender removes its file, extracted text, requirements, drafts and tasks.
• A workspace owner can delete the whole workspace, which removes its stored files and database records. Backups held by our infrastructure providers expire on the providers’ own schedules.
• Anonymous usage events (counts, token totals, latency) may be kept for operating the service.

• No SOC 2, ISO 27001 or similar certification. No third-party penetration test has been completed yet.
• Transport and at-rest encryption are provided by the hosting and database providers; we make no additional encryption claims.
• AI output can be wrong. It is assistive and must be checked against the original documents.
• This is an independent platform, not an official government portal.

Please report suspected security issues through the contact page, marking the message “Security”. We will acknowledge reports and work with you on a fix.