Security
Enterprise-grade security with tenant isolation, role-based access, comprehensive audit trails, and governed agent operations. Built for teams that handle sensitive procurement data.
A note on terms: a “tenant” is your organisation’s workspace in BidAngel. Tenant isolation means no other customer can read or change what is in it.
Where market data ends and your data begins
Multi-tenant isolation isn’t a bullet point — it’s a structural boundary. The canonical procurement backbone is one copy across all tenants. Your workflow, judgement, and content sit in a separate layer that never leaks back up. Three governed crossings move data between them; nothing else does.
Tenant Isolation
- Each tenant operates in a fully isolated data context
- No cross-tenant data leakage by design
- Tenant-scoped queries enforced at the data access layer
- Separate audit trails per tenant
Access Control
- Role-based permissions: admin, proposal lead, contributor, reviewer, read-only
- Explicit permission checks on all state-changing operations
- Invitation-based team membership with controlled onboarding
- Enterprise single sign-on (SAML and OIDC) with domain routing and per-organisation enforcement
- Multi-factor authentication with a per-organisation policy: optional, required for admins, or required for all
- Account lockout, targeted session revocation, and session expiry with secure redirect
Audit Trail
- All meaningful state changes logged with actor, timestamp, and context
- Authentication events, membership changes, and access patterns recorded
- Qualification decisions, requirement approvals, and workflow changes tracked
- Agent operations logged separately with full action provenance
Data Provenance
- Source attribution for all ingested procurement data
- Extraction method and confidence tracking for AI-derived content
- Version history for opportunities, documents, and requirements
- Clear distinction between advisory (AI-generated) and approved (human-reviewed) state
Document Handling
- Secure object storage for solicitation documents and attachments
- Content hashing for integrity verification
- Access-controlled document retrieval
- Structured extraction with source traceability
Error Monitoring
- Unexpected errors in the API and the web application are reported to our error-monitoring provider, Sentry, so they are seen and fixed rather than waiting for a customer to notice
- Before a report leaves our systems we remove authorization and cookie headers, tenant identifiers, IP addresses, request bodies, query strings, email addresses and anything shaped like a credential
- Reports identify a user only by a pseudonymous identifier. No session recordings and no performance traces are collected
- Sentry is listed, with what it receives and how long it keeps it, in our Data Processing Agreement and retention schedule
Agent Governance
- Agents act through typed, bounded tools with clear action classifications
- Consequential actions require explicit human approval before execution
- All agent actions recorded with request, result, and approval status
- Agent operations respect tenant and role permission boundaries
Compliance posture
BidAngel holds no third-party security certification today. We are building toward SOC 2 Type II, and we would rather state that plainly than let a reviewer discover it at the end of an evaluation.
Our data retention schedule sets out how long each kind of data is kept and when it is deleted. An export of your workspace is available on request, produced by an operator; deletion at termination is also performed by an operator, and we confirm in writing what was deleted and what remains in backups until they expire. Not yet available: self-service export and deletion, and application-level encryption of personal data fields. Contact us to discuss your enterprise security requirements.
Reporting a vulnerability
Report suspected vulnerabilities to [email protected]. Include what you found, how to reproduce it, and the affected URL or endpoint. We acknowledge good-faith reports and keep you informed as we investigate and fix.
Test only against your own account and data. Do not access, modify or delete other customers’ data, degrade the service, or use social engineering or physical attacks. We do not run a paid bug bounty, and we will not pursue legal action against research that follows these rules. Our machine-readable contact is at /.well-known/security.txt.