Security and data handling
BidProof holds the evidence and answers a supplier uses to win public contracts. This is how that data is protected.
Where your data is held
Your data is held in London, and evidence files are kept in private storage, served only to someone allowed to see them. Email is sent through Brevo, and only for sign-in, invitations and notifications.
Who can see it
Every table checks, in the database itself, that the person asking belongs to the organisation and holds a role that allows it: owner, admin, editor, approver or viewer. A partner sees a client only while the client allows it, and the client can end that access at any time.
ThinkTribal staff see counts across organisations, never your answers or evidence. When support needs to look, a session is opened for a stated reason, lasts 60 minutes, is read-only unless a change is separately confirmed with its own reason, and your owners can see who looked, when and why.
How access is protected
Every account uses an authenticator app as a second factor. A new account has seven days to set one up, and sharing, invitations and the console need it from the start. Share links and invitation links are shown once; only a fingerprint of each is stored.
An audit log records sensitive actions in a chain where each entry seals the one before, and the chain is checked every time the log is viewed, so an altered entry shows.