Security
How we protect your bid data
Tenders, prices and company records are commercially sensitive. These are the safeguards Bidligence runs on today.
Encrypted everywhere
Every connection uses TLS, and browsers are told to use HTTPS only (HSTS). Data and files are encrypted at rest by our hosting and database providers.
Your workspace is yours
Every request is checked against the workspace you belong to and the role you hold, so one customer can never read another's bids, documents or prices.
Accounts
Sign in with Google or GitHub, a single-use e-mailed link, or a password. Passwords are stored only as bcrypt hashes and are checked for strength and against passwords exposed in public data breaches when they are set. Optional two-factor sign-in adds a code from an authenticator app to every way in, with single-use recovery codes. Sign-in, sign-up and password reset are rate-limited and never say whether an address has an account, reset links expire after three minutes, and signing out of all devices ends every session at once.
Payments
Card details go straight to Paddle, our merchant of record. Bidligence never sees or stores a card number.
Staff access
Bidligence staff access needs an authenticator-app code on top of sign-in and is checked on every request. Opening a customer's bid content needs a recorded reason, is logged in an audit trail staff cannot edit, and is e-mailed to the workspace's admins.
Your data, your call
Admins can export everything in their workspace, or delete it, from Settings → Workspace & data. Every export is announced to all of the workspace's admins.
Reporting a vulnerability
If you believe you have found a security problem in Bidligence, e-mail security@bidligence.com with the steps to reproduce it. Please give us a reasonable time to fix it before telling anyone else.
While testing, use only accounts and workspaces you own, do not access or change other customers' data, do not run denial-of-service or automated volume testing, and do not use social engineering against our staff or customers. Research that follows these rules in good faith is welcome, and we will not pursue legal action over it.
The machine-readable contact details are in security.txt. How we handle personal data is set out in the Privacy Policy.