Security built into the workflow.
BiddingOS handles sensitive tender and client information. These are the principles and controls the product is built on.
Tenant isolation
Every client, tender, document, requirement, evidence record and proposal belongs to exactly one consultancy. Database access rules prevent any other consultancy from reading or changing it, including through direct requests.
Authentication
Users sign in with email and password or Google. Sessions are validated by the server on every protected request.
Authorization & role-based access
Each member has one workspace role — Consultancy Admin, Bid Manager, Reviewer, Contributor or Viewer. Platform administration is a separate role that does not grant access to consultancy client or tender content.
Permission enforcement
Permissions are checked in the database for every create, edit, delete, verification and status change. Hiding a button is never the only protection. Users cannot grant themselves permissions or change their own role, and the last administrator of a workspace cannot be removed.
Audit logging
Evidence reviews, compliance changes, proposal versions, readiness decisions, invitations, role changes and permission changes are written to append-only logs by the database itself. The actor is taken from the signed-in identity; entries cannot be edited or deleted by users.
Evidence verification
Only people with verification permission can verify evidence. A requirement can be marked Compliant only when every condition is covered by verified, unexpired evidence from the same client.
AI boundaries
AI suggests requirements, evidence matches and proposal drafts. It cannot verify evidence, mark compliance, approve drafts or mark a tender ready. References to records that do not exist are discarded.
Demo / production separation
Demo workspaces contain clearly labelled illustrative data. Demo records cannot be added to production workspaces, and demo evidence can never establish real compliance.
Licensing enforcement
Workspace access state is evaluated by the server. An inactive workspace becomes read-only — data is never deleted because a licence lapses.
Data access principles
Least privilege by default: members see their own workspace only, platform administrators see workspace metadata only, and deactivated members lose access immediately while their history is preserved.
BiddingOS does not currently hold third-party security certifications. Found a vulnerability? See Responsible Disclosure in the footer.