Security and privacy

Procurement documents are sensitive. They contain pricing, strategy, technical details, and sometimes personal data. Here's how we handle them.

Data storage

Documents are stored in Amazon S3 (AWS cloud storage) with encryption at rest. Access is restricted to your organization's account - other users can't see your files.

Analysis results, findings, scores, and metadata are stored in a PostgreSQL database, also encrypted at rest.

All connections between your browser and our servers use HTTPS (TLS encryption in transit).

Who can access your data

• Your organization members - everyone in your organization sees all procurements, documents, and results. In a regulated procedure published on Tendergate, only the openers and evaluators read the opened bids, their prices and the award decision
• Platform administrators - for troubleshooting and support purposes only
• No one else - your data is not shared with other customers, and not used to train AI models

AI processing

When you run an analysis or composition, your documents go through two layers of isolation before they reach an AI model:

Per-run sandbox

Each AI run (bid analysis, RFP composition, RFP review, prep checklist, market research, etc.) runs inside a fresh, throwaway workspace called a sandbox — essentially a dedicated container created specifically for that one run. Your documents are uploaded into that sandbox at the start of the run, and only the agent driving that run can read them.

• Different runs (and different organizations) get different sandboxes — one run never sees another run's files.
• When the run finishes, the sandbox is destroyed. No state lingers.
• If a run pauses for clarification, the sandbox is preserved exactly as the agent left it (so you can resume later) but stays just as isolated.

AI provider boundary

The agent inside the sandbox calls AI services (language models) when it needs to reason or generate text. Here's what that means:

• Document text is sent to the AI provider in the conversation as the agent reads files and works.
• The AI provider doesn't store your data for training purposes. We use API access with data processing agreements that prohibit training on customer data.
• Processing uses APIs — text is sent for processing and a response is returned. This does not itself imply zero retention for every service.

The AI providers we use (Anthropic, OpenAI, Google) all offer enterprise API terms with clear commitments about not using API data for model training.

Document parsing and the Library

Workspace tools extract text and tables from PDF, Word and Excel files. Scanned pages and images can be read by an AI image model; this is not exclusively a local OCR process.

Documents added to the Library also have a persistent content-search index:

• Extracted text, OCR checkpoints, passages, location references, coverage and numerical content representations (embeddings) are stored in the database, scoped to your organization.
• Library passages and search queries are sent to OpenAI for embeddings using platform credentials, even when you bring your own API key (BYOK) for agents.
• Library scanned-page/image reading uses the platform's AI provider. Subsequent agent judgment can use your configured provider.
• This indexing applies only to Library entries, not every procurement document. The extraction workspace is deleted after its attempt; stored Library passages remain for repeat searches.
• Searches check organization and current source identity. Partial reading, OCR errors and document validity still require checking the original.

This describes data routing; the particular AI service's retention terms depend on the applicable service terms and configuration.

Sealed bids

Bids on tenders published on Tendergate are sealed by default:

• The bidder's browser encrypts each file and the prices before upload, with a new key for every file. Tendergate's servers store only encrypted data.
• The Tendergate app holds no key that can open the bids. The keys are held by a separate sealing service, which releases the bids only after the deadline and only when the buyer's openers approve with their opening keys. Every opening is recorded in a log that cannot be changed.
• Before the opening, nobody in the buyer's organization can see who has bid, or how many bids there are. A bidder's draft prices stay in the bidder's browser until they submit, and only the bidder's team sees its bid check.
• Tendergate operates the sealing service and holds its keys, so that opening is possible. Someone with direct access to those keys could decrypt bids outside the app. Every opening through the app needs the openers' approval and is signed.
• The bid, opening and receipt pages load no analytics, advertising or session-recording tags.

Under the private rules, a buyer can choose open bids instead. The buyer then sees each bid as it arrives, and bidders are told so on the tender page before they bid.

The full explanation, including who can access the keys, is public at tendergate.ai/sealed-submissions. See also Receipts and verification.

Authentication and access

• Email and password authentication
• Sign in with Google - available on the registration and login pages as an alternative to a password
• Two-factor authentication - an optional second step after the password or Google sign-in, with an authenticator app, a passkey or a single-use backup code. Owners and admins can require it for every member. See Two-factor authentication
• Passkeys - sign in with your fingerprint, face or device PIN, without a password
• Rate-limited sign-in - repeated failed sign-in attempts are throttled, both from a single source and against a single account, to protect accounts from password guessing
• Organization-based access - you see everything in your organization, nothing from others
• No public access - all data requires authentication, except what you publish yourself: a tender published on Tendergate, its documents and its published answers are public on the tender page. An invite-only tender is visible only to people with its link

Audit log

Owners and Admins can see who did what in the organization, and when, under Account settings → Audit log. Each entry shows the time, the user, the action, the object it affected, details, and the IP address. Entries can't be changed or deleted.

The log covers these categories:

• Sign-in - sign-ins with the second step used, sign-outs, failed sign-ins, failed two-factor checks, password changes, and two-factor changes: turned on or off, authenticator apps and passkeys added or removed, backup codes regenerated or used, and a reset by Tendergate support
• Members - invitations, added and removed members, and role changes
• Documents - uploads, deletions, and file downloads
• Library - documents added, archived, or deleted
• Procurements and bids - procurements and bids created or deleted
• Tender selection - tenders shortlisted or dismissed, with the dismiss reason, and undone decisions
• AI agents - AI runs started or resumed, including tender recalculations and eligibility checks
• Edits - records created, edited, or deleted, such as lots, evaluation criteria, items, and requirements
• Exports - Excel, Word, and ZIP downloads
• Settings - changes to tender selection and scoring settings, tender services and the company profile, the company linked in the register, model providers, planning, billing details, the organization's two-factor requirement, and the monthly AI usage limit
• Security - attempts to do something your role doesn't allow, and audit log exports
• Publishing - tenders created, published, amended, cancelled, opened and awarded, invitations, opener changes, declarations and other records of tenders you publish on Tendergate
• Submissions - bids submitted, replaced and withdrawn on tenders published on Tendergate

Failed sign-ins and failed two-factor checks are highlighted in red. For edits, the log records which fields changed, never their values.

Filter the list by user, category, and date range; it shows 50 entries per page. Export CSV downloads the filtered entries, and each export is itself recorded in the log.

AI Assistant memory

The AI Assistant keeps short memories: facts and preferences people state in their own messages, each up to 300 characters. It does not learn from documents, uploads or research, and it refuses to store passwords, keys and other credentials, or sensitive personal data such as health details, home addresses, private phone numbers or personal ID numbers. Organization memories are visible to every member of the organization. Personal memories are visible only to the person they belong to, not even to the organization's owners or admins, and are deleted when that person leaves the organization. A memory deleted under Account settings → Memory is removed at once; a memory the assistant is asked to forget is deleted permanently after 7 days.

Data export

An organization owner can ask for a copy of all the organization's data: uploaded documents, analysis results, drafted documents, research, reports, and the records behind them. Open Account settings → Organization, and under Export your data select Request data export. We prepare the export and email you a download link within one business day. The request is recorded in the audit log.

Before you delete your account, request an export first if you want to keep your data.

Data deletion

When you delete a procurement, all associated data is removed:

• Uploaded documents are deleted from storage
• Analysis results, findings, and scores are deleted from the database
• This is permanent and cannot be undone

Archiving a Library document immediately excludes it and its children from search; its index may remain for history and restoration. Replacing the source file immediately excludes old passages, and a background job removes obsolete indexes. Hard-deleting a Library entry removes its passages and indexes. Existing usage can require archiving instead of deletion. An entry saved from a procurement references its source Document rather than creating an independent original-file backup.

When you delete your account, all your data is removed.

Records of a tender published on Tendergate are the exception. They are kept for the retention period the rules set, for example 5 years from the award for a private purchase, and cannot be deleted before then, even if members leave. If you delete your account while you are an organization's only member, the organization is archived: its memberships are removed and its tender records stay until the retention period ends. See Record retention.

What we don't do

• We don't sell your data
• We don't use your documents to train AI models
• We don't share your data with third parties (except the processing services described above, and what you publish yourself, such as a tender on Tendergate)
• We don't access your documents unless you explicitly ask for support help, or when we check your organization's first published tender before it goes live