Your data and security

Allow support in, and end it

Let Biddable support see inside your space for 24 hours, 72 hours or 7 days, and end it whenever you like.

Who can use it

Owners. Every member sees the line while support access is on.

Where it is

Account, the Support access card

In

The web app, and the phone, tablet and desktop app

What it does

Your space is closed to Biddable staff. If you want help with something inside it, an owner lets support in for a time they choose, with a note of why. Every look is written in the access log, and you can end it at any time.

Step by step

1. Open Account and find Support access.
2. Under For how long, press 24 hours, 72 hours or 7 days.
3. Write what you would like looked at in Why (optional).
4. Press Let Biddable support see this space. If you have not given a second factor in the last fifteen minutes, you are asked for one first.
5. To end it early, press End support access now.

What you see

• After allowing it: "Support can now see this space. Every look is in the Access log." The card then shows the badge Support can see this space, "until" the end time, Why and Allowed by.
• A line under every page's header for every member: "Biddable support can see this space until" the end time, with your note. "The owner can end it under Account."
• After ending it: "Support access ended. You will get a summary by email."
• Below, up to five earlier grants with their length, who allowed them and whether they expired or were ended.

Good to know

• The owners are emailed when access is given, the first time support opens something under it, and with a summary of what was opened when it ends, whether it ran out or was ended.
• Allowing support needs a second factor from the last fifteen minutes; ending it does not.
• Support may ask for access. That emails the owners a link to this card; nothing opens until an owner allows it.
• Without a grant, support sees only what running the service and billing needs: your plan, usage, members and whether runs worked. Never your bids, documents, chats or outputs.
• It works in a paused or read-only space, and in the phone, tablet and desktop app.

Common questions

Can support change things while they are in?

While the grant lasts, support can open and work in the space. Everything they open or change is a line in your access log, so you can see exactly what was done.

What if I forget to end it?

It ends by itself at the time shown, and the owners get the summary email.

Back to the top

Read the access log

See every look at your space by anyone outside your team, and your team's own sign-ins and security changes.

Who can use it

Owners

Where it is

Access log, in the menu (web app); Account, the Access log card (phone, tablet and desktop app)

In

The web app, and the phone, tablet and desktop app

What it does

Each space has its own access log, kept in the space. It records every time anyone outside your team looks at or changes something in it: Biddable staff, support under your grant, the automatic set-up, anything done from the server, and every refusal. Under a filter it also shows your own team's sign-ins and security changes. Nobody can edit or remove a line.

Step by step

1. Open Access log (in the phone, tablet and desktop app: Account, then the Access log. card).
2. Check the line at the top: Intact, when it was checked, the number of entries and the fingerprint.
3. Pick a filter: Outside your team (the default), Your team or Everything.
4. Read each line: who, when, what was done and to what, any detail, and the address it came from.

What you see

• Intact with "Verified [time] · N entries · fingerprint" and sixteen characters. The log is checked from its first line every time the page opens.
• If the check fails: Warning and "The log does not check out from entry N", with the reason, then "Something changed it outside the app. Download the log, keep it, and tell us at once."
• Each line: who (for example "Biddable support", "Automatic set-up" or a colleague's address), the time, the action and what it touched, and "From" an address.
• "Nothing here yet." when a filter has no lines.

Good to know

• The log is kept for as long as the space exists, and at least twelve months.
• Downloading the log, switching the weekly email and asking to delete a bid are lines in it too.
• The web app shows the latest 300 lines; the phone, tablet and desktop app the latest 100. The CSV download has every line.
• The phone, tablet and desktop app have no CSV download or weekly email switch: use the web app for those.
• Only owners see the log.

Common questions

Why are there lines from "Automatic set-up"?

While your space was being set up, the documents you sent were read to prepare it. Those reads, and the clean-up when set-up finished, are in the log.

A line says something was refused. Is that a problem?

No. It means someone outside your team tried to open something without your grant and the server said no.

Back to the top

Keep a copy of the log, and the weekly email

Download the whole access log as a CSV file with every line's hash, and switch the weekly fingerprint email on or off.

Who can use it

Owners

Where it is

Access log: Download as CSV, and the weekly email switch (web app)

In

The web app only

What it does

Download as CSV saves every line of the access log, oldest first, with each line's hash, so you hold your own copy and can check it yourself. The weekly email sends the owners a one-line note of the log's size and fingerprint; kept, those emails let you show later that nothing was changed.

Step by step

1. Open Access log in the web app.
2. Press Download as CSV. The file opens in a new tab or downloads, depending on your browser.
3. Keep the file somewhere of your own.
4. To stop or start the weekly email, use the switch beside "A one-line weekly email with the log's fingerprint."

What you see

• Beside the button: "The file carries each line's hash, so you can check the chain yourself."
• The file's columns: seq, time_utc, ts, who_kind, who, action, what, detail, from, prev_hash and hash. Times in time_utc are in UTC.
• Your download becomes a line in the log: "downloaded the access log".
• The weekly email, "your access log this week", opens with "Your access log: N entries, fingerprint" and the first sixteen characters of the latest hash, the same fingerprint the page shows.
• Switching the email on or off adds a line to the log.

Good to know

• The weekly email is on unless an owner switches it off, and goes to every owner. The first one is sent a week after the log's first line.
• The support access emails carry the fingerprint too.
• Both work in a paused or read-only space.
• The phone, tablet and desktop app show the log but not these two: they say to open Access log in a browser.

Common questions

Why keep the weekly emails?

Each one records how long the log was and how it ended that week. If anyone rewrote the log afterwards, its fingerprint would no longer match the email you already hold.

Back to the top

Check the access log yourself

Recompute the access log's chain of hashes from the CSV download, so you need not take the page's word for it.

Who can use it

Owners, or anyone they give the CSV file to

Where it is

Outside the app, with the CSV from Access log, Download as CSV

In

A page or email outside the app

No clip for this one: A check done outside the app on the downloaded file: there is no screen to film beyond the download, which the previous clip shows.

What it does

Every line of the access log carries a hash made from the line before it and its own content. Recomputing those hashes from the CSV file shows whether any line was changed, removed or put in after the fact. Comparing the result with the fingerprint in an email you kept shows that the whole log was not rewritten. Anyone comfortable with a spreadsheet formula or a short script can do it.

Step by step

1. Download the log with Download as CSV on the Access log page (web app). The rows are oldest first.
2. Start with the first row. Its prev_hash must be 64 zeros. For every later row, prev_hash must equal the hash of the row before, and seq must go up by exactly one.
3. For each row, write out its content as compact JSON with the keys in this order: action, actor, actor_kind, detail, ip, seq, ts, what. Take actor from the who column, actor_kind from who_kind and ip from from; the others have the same names. Write seq and ts as numbers, copied exactly as they appear in the file, and the rest as text in double quotes. Use no spaces between items, and keep accented letters as they are.
4. Put the row's prev_hash in front of that JSON, with nothing between them, and take the SHA-256 of the whole text (UTF-8). Written in lower-case hexadecimal, it must equal the row's hash.
5. Take an email you kept (the weekly email, or a support access email). It says "Your access log: N entries, fingerprint" and sixteen characters. Find the row whose seq is N: the first sixteen characters of its hash must be that fingerprint.

What you see

• One row of the JSON looks like this, all on one line: {"action":"support access allowed","actor":"owner@example.com","actor_kind":"member","detail":"…","ip":"…","seq":12,"ts":1760000000.123,"what":"for 24 hours"}
• When every row matches, the log is as it was written. The first row that does not match is where it was changed.
• The Access log page runs the same check every time it opens and shows Intact, or Warning with the first entry that fails.

Good to know

• Copy seq and ts from the file as they are. A tool that rewrites the numbers (for example dropping a ".0") gives a different hash.
• Text values are escaped the way JSON does it: a double quote or backslash inside a value gets a backslash in front, and a line break becomes \n.
• The log only grows, so an older email still checks against the row it names, however many lines came after it.
• If a check fails, keep the file and the emails, and tell your Biddable contact at once.

Common questions

Do I have to do this?

No. The page checks the whole chain every time it opens. This is for anyone who wants to check it independently, for example for an audit.

Back to the top

Add or remove a second factor

Add another way to confirm it is you at sign-in, or remove one you no longer use.

Who can use it

Everyone, for their own account

Where it is

Account, the Security card, Add a second factor, Remove

In

The web app, and the phone, tablet and desktop app

What it does

Everyone signs in with two steps. Your second factors are listed on Account under Security.: an authenticator app, a passkey, or a code emailed after your password. Keep more than one, so losing a device does not lock you out.

Step by step

1. Open Account and find Security.
2. Press Add a second factor and choose one:
3. Authenticator app: scan the QR code with the app (or press Add to an app on this device, or Copy key and type the key), enter the six-digit code under Code from the app, name it if you like, and press Confirm.
4. Passkey: name it if you like and press Create the passkey, then follow your device's prompt (Touch ID, Face ID, Windows Hello or a security key).
5. Emailed code: press Use emailed codes. It needs a password on your account first.
6. If this is your first factor, save the recovery codes shown, then press I have saved them.
7. To remove one, press Remove beside it and confirm it is you.

What you see

• A badge with the number of second factors, and "Signed in this time by:" with how you signed in.
• Each factor with its kind, its name, when it was added and when it was last used. A passkey shows the address it was made for, and "(not this address)" if it was made elsewhere.
• "Added." or "Removed." under the list.
• An email each time a factor is removed.

Good to know

• Adding or removing a factor needs a second factor from the last fifteen minutes. If yours is older, Add a second factor and Remove ask for one first ("Confirm it is you."), then carry on.
• Remove appears only while you have more than one factor: you always keep at least one.
• A passkey works only on the web address it was made on. Made on another address, it is marked and cannot be used here: add one here too, or keep an authenticator app.
• The phone, tablet and desktop app offer the authenticator app and the emailed code. Passkeys are added and used in a browser.
• Lost every factor? Use a recovery code, or ask an owner to reset your second factor.

Common questions

Which should I choose?

An authenticator app works everywhere, offline too, and is the one we recommend. Add a passkey as well on a computer you use often.

Back to the top

New recovery codes

Make a fresh set of ten recovery codes when yours are used up or may have been seen; the old ones stop working.

Who can use it

Everyone, for their own account

Where it is

Account, the Security card, New recovery codes

In

The web app, and the phone, tablet and desktop app

What it does

Recovery codes get you in if you lose your phone or security key. Each works once. New recovery codes makes a fresh set of ten and the old set stops working at once.

Step by step

1. Open Account and find Security. The button shows how many codes you have left: New recovery codes (N left).
2. Press New recovery codes. If you have not given a second factor in the last fifteen minutes, you are asked for one first.
3. Save the ten codes somewhere safe, outside the browser: Copy copies them all, Download saves them as a text file.
4. Press I have saved them.

What you see

• "Save your recovery codes." with the ten codes and "If you lose your phone or security key, one of these gets you in. Each works once. Keep them somewhere safe, not in this browser; they are shown only now."
• An email saying a new set was made and the old ones no longer work.

Good to know

• The codes are shown once. If you lose them, make a new set.
• You need at least one second factor before you can have recovery codes.
• To use one, choose Recovery code at the second step of signing in.

Common questions

I have used most of my codes. What now?

Make a new set here. The count on the button shows how many are left.

Back to the top

Where you are signed in

See every sign-in to your account for the last twelve months, and sign out every other device at once.

Who can use it

Everyone, for their own account

Where it is

Account, Where you are signed in: Show sign-in history, Sign out everywhere else

In

The web app, and the phone, tablet and desktop app

What it does

Where you are signed in. lists every sign-in to your account, including the ones that failed, for twelve months. Sign out everywhere else ends every session but the one you are using, for a lost device or a sign-in you do not recognise.

Step by step

1. Open Account and find Where you are signed in.
2. Press Show sign-in history to see the list. Hide history folds it away.
3. If something looks wrong, press Sign out everywhere else.
4. Then change your password and tell an owner of your space.

What you see

• "N active sessions." above the list.
• Each sign-in with a green or red dot, the time, the method (Password, Emailed code, Authenticator app, Passkey, Recovery code or Single sign-on), "failed" where it failed, and the browser and address it came from.
• After signing out the others: "Every other session was signed out.", and an email saying so.

Good to know

• You get an email when a browser or device you have not used before signs in.
• Changing your password also signs out every other session.
• It works in a paused or read-only space.

Common questions

I see a sign-in I do not recognise.

Press Sign out everywhere else, change your password, and tell an owner, who can reset your second factor if needed.

Back to the top

Change your password

Set a password, change it, or reset a forgotten one after signing in with an emailed code.

Who can use it

Everyone, for their own account

Where it is

Account, the Password card, Save password

In

The web app, and the phone, tablet and desktop app

What it does

A password lets you sign in without waiting for an emailed code. You can change it with your current password, or, if you have forgotten it, sign in with an emailed code and set a new one within thirty minutes.

Step by step

1. Open Account and find Password.
2. Enter your Current password. Leave it empty if you signed in with an emailed code in the last thirty minutes.
3. Enter your New password, at least 12 characters.
4. Press Save password. If you have not given a second factor in the last fifteen minutes, you are asked for one first.

What you see

• With no password yet: "Optional: set one to sign in without waiting for a code. At least 12 characters."
• With one: "Change it with your current password, or within 30 minutes of signing in with an emailed code."
• Save password stays greyed out until the new password has 12 characters.
• After saving: "Password saved. Other devices signed in to this account have been signed out."
• If the current password is wrong: "Enter your current password, or sign in with an emailed code to reset it."

Good to know

• Saving a password signs out every other session of your account, and you get an email saying it was set or changed.
• It needs a second factor from the last fifteen minutes, except a very first password set straight after signing in with an emailed code.
• It works in a paused or read-only space.
• If your organisation requires single sign-on, you sign in through it instead, unless you are one of the owners kept as a break-glass way in.

Common questions

I forgot my password.

On the sign-in page, ask for an emailed code instead. Once in, open Account, Password and set a new one within thirty minutes, leaving Current password empty.

Back to the top

Members: add someone, change a role and remove someone

Add a colleague to your space as an owner, writer or reviewer, change someone's role, and remove someone who has left.

Who can use it

Owners

Where it is

Account, the Members card: Add someone, Add and email them, Change role, Remove

In

The web app, and the phone, tablet and desktop app

What it does

The Members. card lists everyone in the space with their role. An owner adds someone with their email address and a role, and they are emailed a way to sign in. Remove takes someone out of the space.

Step by step

1. Open Account within fifteen minutes of signing in, and find Members.
2. Under Add someone, type their Email.
3. Pick a Role: owner, writer or reviewer.
4. Press Add and email them.
5. To change someone's role, press Change role beside their name, pick owner, writer or reviewer, and confirm.
6. To take someone out, press Remove beside their name and confirm.

What you see

• Each member with their name, address and role, and "code only" for someone who has no password yet.
• After adding: "Added. They sign in with an emailed code."
• After a role change: "… is now a writer." (or an owner, or a reviewer).
• "Confirm it is you to see the members" with a Confirm it is you button when your last second factor is more than fifteen minutes old: press it, confirm, and the list appears.

Good to know

• The roles: an owner has everything, plus the members, the plan and security settings; a writer works on every bid; a reviewer reads the bids and changes nothing.
• The members list, adding, changing a role and removing all need a second factor from the last fifteen minutes; you are asked for one when it is needed.
• Remove asks "Remove …? They lose access to this space." first.
• Adding an address that is already a member is refused ("… is already a member here, as writer. Use Change role to change it."): nobody's role changes by accident, and nobody is emailed again.
• A space always keeps at least one owner: removing the last one, or changing their role, is refused with "A space needs at least one owner. Make someone else owner first."
• Someone removed can no longer open the space; any other space they belong to is not affected.
• Every addition, role change and removal is in the account's audit log.

Common questions

Someone in my team left. What do I do?

Remove them here. They can no longer open the space.

Can a writer add people?

No. Only owners see the Members card.

Back to the top

Reset a colleague's second factor

Help a colleague who has lost their phone or security key: their second factors go and they set up a new one at their next sign-in.

Who can use it

Owners

Where it is

Account, the Members card, Reset 2nd factor

In

The web app, and the phone, tablet and desktop app

What it does

When a colleague has lost every second factor and their recovery codes, an owner resets them. All of their second factors and recovery codes are removed, every session they have ends, and at their next sign-in they set up a new second factor.

Step by step

1. Open Account within fifteen minutes of signing in, and find Members.
2. Press Reset 2nd factor beside your colleague.
3. Confirm. If you have not given a second factor in the last fifteen minutes, you are asked for one.
4. Tell your colleague to sign in again. They are asked to set up a new second factor straight after.

What you see

• The question: "Reset [their address]'s second factors? They are signed out everywhere and set up a new one at their next sign-in." (in the phone, tablet and desktop app: "Reset their second factors?").
• After the reset: "[their address] will set up a new second factor at their next sign-in."
• Your colleague gets an email: "Your second factors were reset", naming who reset them.

Good to know

• The button is not shown beside your own name. If you lose your own factors, use a recovery code, or ask another owner.
• It needs a second factor from the last fifteen minutes. The Members list itself shows only within fifteen minutes of signing in; otherwise sign out and in again first.
• Every reset is in the account's audit log.

Common questions

Does a reset remove their password?

No. Only their second factors, recovery codes and sessions. They sign in as before and then set up a new second factor.

Back to the top

Single sign-on settings

Let your people sign in through your organisation's Google Workspace or identity provider, and decide whether they must.

Who can use it

Owners

Where it is

Account, the Single sign-on card, Set up…

In

The web app, and the phone, tablet and desktop app

What it does

Single sign-on lets people on your organisation's email domain sign in with Google Workspace, or with your identity provider (Okta, Microsoft Entra ID and others) over SAML 2.0. It applies to every space on your account. People are matched by email to members you have already added; nobody joins by signing in unless you turn auto-join on.

Step by step

1. Ask your Biddable contact to add your email domain. An owner cannot add a new sign-in domain.
2. Open Account within fifteen minutes of signing in, find Single sign-on. and press Set up…
3. For Google Workspace, press Sign in with Google: off to turn it on.
4. For SAML, give your IT the details listed under the SAML heading (SP metadata, Entity ID, ACS URL, NameID) so they can create the application. Paste their metadata into IdP metadata XML (paste) and press Read the metadata. Check IdP entity ID and IdP sign-in URL, then press SAML sign-in: off to turn it on.
5. Under Rules, list at least one owner as a break-glass owner and press Save.
6. To make single sign-on the only way in for your domain, press SSO required: off to turn it on.
7. If you want a second factor asked for after single sign-on as well, turn on Also ask for a second factor after SSO.
8. For Auto-join, pick a space and as reviewer or as writer, then press Auto-join: off to turn it on.

What you see

• The badge: Off, On or On · required.
• After reading the metadata: "Metadata read. Check the details and turn SAML on." and the signing certificate with its expiry date.
• Messages such as "SAML sign-in is on for your domains.", "Google sign-in is on for your domains.", "Members on your domains must now use single sign-on." and "Auto-join is on."
• On the sign-in page, someone who types an address on your domain sees Sign in with SSO (or Sign in with Google), with "Or sign in with a code or password below." unless SSO is required.

Good to know

• Every change needs a second factor from the last fifteen minutes, and so does seeing the settings: after that the card shows Confirm it is you, and once you confirm it opens. A save keeps you on the card.
• Under Your email domains the card lists the domains on your account, each with Remove. A new domain is added by your Biddable contact; the card says so.
• Sign in with Google can be turned on only where the server offers Google sign-in. If it does not, the card says so.
• SAML turns on only once the entity ID, sign-in URL and signing certificate are all in. SSO required turns on only once Google or SAML is on and a break-glass owner is named.
• Break-glass owners keep the password, emailed-code and passkey ways in when SSO is required, so the account cannot lock itself out: on the sign-in page they press "An owner who keeps another way in?". Only owners can be listed.
• By default single sign-on counts as both steps, because your identity provider does its own second step.
• Every owner is emailed when the settings change, and each change is in the account's audit log.
• In the phone, tablet and desktop app, signing in with single sign-on opens the browser, and the app is signed in when it comes back.

Common questions

Someone on our domain cannot get in with single sign-on.

Single sign-on lets in only members you have added; anyone else is told to ask you. Add them under Members, or turn on auto-join for your domain.

Back to the top

The account audit log

See who changed the account's members and security settings, and when, for the last twelve months.

Who can use it

Owners

Where it is

Account, the Audit log card, Show

In

The web app, and the phone, tablet and desktop app

What it does

The audit log records changes to the account: members added and removed, second factors reset, sign-in settings changed. Each line says when, who did it, what was done and to whom. It covers every space on your account and keeps twelve months.

Step by step

1. Open Account and find Audit log. near the foot.
2. Press Show.
3. Read the lines, newest first. Press Hide to fold them away.

What you see

• "Members added and removed, second factors reset, sign-in settings changed: who did what, kept for twelve months."
• Each line: the date and time, who did it, the action, and who or what it was done to, with any detail.
• "Nothing yet." when there is nothing to show; if the log cannot be loaded, the reason in red instead. Press Hide and Show to try again.

Good to know

• The audit log is about the account's people and settings. Every look at your space from outside your team is in the access log instead.
• Lines older than twelve months are removed.
• Only owners see it.

Common questions

What is the difference between the audit log and the access log?

The audit log records changes to the account's members and sign-in settings. The access log records every look at the space by anyone outside your team, and your team's sign-ins and security changes, and can be checked line by line.

Back to the top

Download everything

Get the whole space in one zip file: bids, documents, outputs, library, rules, settings and conversations.

Who can use it

Owners

Where it is

Account, the Download everything card

In

The web app, and the phone, tablet and desktop app

What it does

Download everything puts the whole space into one zip file: your bids with their documents and outputs, your library, your rules and settings, and the conversations as data. It is made in the background; you are emailed when it is ready, and it is kept for seven days.

Step by step

1. Open Account and find Download everything.
2. Press Download everything. If you have not given a second factor in the last fifteen minutes, you are asked for one first.
3. Wait for the email, "Your Biddable download is ready".
4. Open Account in the web app and press Download on the same card.
5. To make a newer copy later, press Make a fresh one.

What you see

• While it is made: "Being prepared. We email you when it is ready." The button is greyed out meanwhile.
• If one was cut off part-way (it has not finished after an hour): "This one did not finish. Make a fresh one.", with Make a fresh one.
• When it is ready: "Ready until" the date it is removed, with Download (web app) and Make a fresh one.
• If it could not be made: "The last one could not be made. Try again, or reply to any of our emails."
• In the phone, tablet and desktop app, when ready: "Download it from Biddable on the web."

Good to know

• Asking for it works in the web app and in the phone, tablet and desktop app; the zip itself downloads in the web app only.
• It works in a paused or read-only space, so you can always take your work away.
• The request, the moment it is ready and each download are lines in your access log. Nobody at Biddable opens it.
• Once the zip has been made, no bid built before it can be deleted and given back to the allowance: the zip holds every bid's documents.
• Make a fresh one replaces the earlier zip.

Common questions

How do we get our data deleted after taking a copy?

Ask your Biddable contact. Deletion is confirmed in writing.

Back to the top

Ask for your account to be deleted

Ask for your space, its records and your sign-in to be deleted, after one export of everything in it.

Who can use it

Everyone: the card shows to every member

Where it is

Account, Delete your account (phone, tablet and desktop app); or by email from any app

In

The phone, tablet and desktop app only

No clip for this one: The card is in the phone, tablet and desktop app only and ends in an email; the web app has no screen for it.

What it does

There is no button that deletes an account straight away. The Delete your account. card opens an email to your Biddable contact asking for it. Your space, its records and your sign-in are then deleted within thirty days, after one export of everything in it at no charge, and you get written confirmation.

Step by step

1. In the phone, tablet or desktop app, open Account and scroll to Delete your account.
2. Press Ask for my account to be deleted. Your email app opens with the message written: the subject "Please delete my Biddable account", your address and your space's name.
3. Send the email.
4. To read what is kept and for how long, press Privacy notice.

What you see

• "Ask and your space, its records and your sign-in are deleted within thirty days, after one export of everything in it at no charge. You get written confirmation. The privacy notice says what is kept and for how long."
• Your email app, with the message ready to send.

Good to know

• The web app has no card for this: write to your Biddable contact by email instead. The address is hello@biddable.ae.
• Nothing is deleted until your request is read and confirmed.
• To keep your own copy first, an owner can use Download everything on Account.
• Deleted data leaves the encrypted backups as they rotate, within about six months.

Common questions

Can I remove just myself from a space?

Ask an owner to remove you under Account, Members.

Back to the top