You are putting live tender data in here. Here is exactly how it is handled.

Every query in the application is scoped to a workspace. There is no code path that reads a record without an org identifier.

Row-level scoping

Every table carries an org_id and every read and write is filtered on it, including exports and background jobs.

Role-based permissions

Five roles map to a capability matrix. Actions check capability before they touch data, not just before they render a button.

Record-scoped access

External participants can only ever see the single requirement, task or approval their link was issued for.

Encryption, retention and deletion are configured per workspace, with defaults that suit a US contractor handling government and commercial bid data.

Encryption in transit and at rest

TLS everywhere; documents held in encrypted object storage separate from the application database.

Data minimization by design

We store what the workflow needs. Contributor links carry a name and email, not an account profile.

Retention and deletion

Configurable retention with a documented deletion workflow, including the right to remove a contributor's personal data.

Backups and tested restoration

Automated backups with restoration tested on a schedule, not assumed.

Sensitive actions need proof of identity, and every session can be ended from the workspace.

MFA for privileged users

Owners and managers can be required to use MFA by workspace policy.

Configurable session controls

Session lifetime and device visibility, with the ability to revoke any active session.

Signed, expiring external links

Tokens are stored hashed, carry an expiry and a use limit, and can be revoked instantly.

File safety controls

Type and size restrictions plus malware scanning before a document is ever attached to a bid.

Material actions are written to an append-only log. Nothing in the product updates or deletes an audit event.

Authentication events

Sign-in, sign-out and session revocation, with device and time.

Record changes

State transitions, condition flags with reason codes, owner changes and decisions.

Automated actions

Every reminder that fires records the rule that created it and the date it measured from.

Exports and settings

Who exported what, and every change to team, roles, retention and automation.

The fastest way to earn trust is to make leaving easy. Nothing about your data is proprietary.

CSV export of every list

Opportunities, requirements, tasks, library items, audit events.

Record package per bid

A timestamped package containing the matrix, responses, evidence index and full activity history.

Document download

Original files, with checksum and version.

No exit fee, no notice period

Cancel in the workspace. Export stays available through the end of the paid term.