Your tenders and bids are commercially sensitive. Here is exactly how we look after them.

In place today

• ✓
  Encrypted in transitEvery connection to Biddable uses HTTPS. Plain HTTP is redirected.
• ✓
  Your data in its own storeEach customer's space has its own separate database and file store on the server. Nothing is shared between customers, and a space's documents never reach another space.
• ✓
  Your space is closed to us by defaultOur staff see only what running the service and billing needs: your plan, usage and costs, your members, and whether a run worked. Not your bids, documents, chats, recordings or outputs. The server refuses those to us, not just the screen.
• ✓
  Support sees inside only if you allow itIf you want our help with something in your space, the space's owner allows support in for 24 hours, 72 hours or 7 days, and can end it at any time. You get an email the first time we open something, and a summary of what we opened when it ends. The one exception is set-up: until you have finished setting up your space, we read the set-up documents you send us to prepare it, and nothing else, and we delete our working once your set-up is finished.
• ✓
  An access log you can see and downloadEvery look at your space by anyone outside your team, ours included, is written in your space's own access log: who, when, what and from where. The owner can read it in the app and download it. Nobody can edit or delete a line through Biddable, and the database itself refuses it; each line is linked to the one before by a hash, the app checks the whole chain each time you open it, and we email you its fingerprint, so a change made any other way would show.
• ✓
  Industry-standard password hashingPasswords are stored only as salted hashes, never in a readable form. Sign-in codes sent by email work once and expire after ten minutes.
• ✓
  Multi-factor authentication for every userEvery sign-in needs a second factor, and every user must set one up: an authenticator app, a passkey or an emailed code. Changing security settings asks for it again.
• ✓
  Single sign-onSign in with Google Workspace, or through SAML with an enterprise identity provider such as Okta or Microsoft Entra ID. Your organisation can make it required for your team.
• ✓
  Secrets encrypted at restKeys and credentials stored by the service, such as authenticator secrets and your own API keys, are encrypted with AES-256.
• ✓
  Sign-in history and audit logEvery user can see where and when their account signed in, and account owners can see changes to members and security settings.
• ✓
  Rate limitingSign-in attempts, code requests and access applications are limited per address and per network location, so accounts cannot be guessed at.
• ✓
  Encrypted nightly off-site backupsEvery night, encrypted copies of the data are taken to a separate location, with daily, weekly and monthly copies kept and checked.
• ✓
  Hosted in the European UnionOur servers are in Germany. The encrypted backups are kept off-site in a separate data centre in the European Union.
• ✓
  Used only for your workYour documents are read by the AI only to do your work, on enterprise terms that forbid using them to train models. They are never shared with another customer.
• ✓
  Yours to take awayEverything you put in and every document produced for you can be downloaded from your space. On request we export your whole space, or delete it.
• ✓
  Owned and operated by Toga EMEA FZC LLCBiddable is a product of Toga EMEA FZC LLC, United Arab Emirates. It is a hosted service: each customer has a locked space, and there is no on-premise version.

What we do not claim

Biddable does not hold a security certification such as ISO 27001 or SOC 2, and we will not say it does until it does. If your procurement process needs a specific control, a questionnaire or a data-processing agreement, say so when you apply, or email hello@biddable.ae, and we will answer it directly.

The honest limits

We run the server, so the service itself has to read your documents to do the work you ask of it. Secrets such as authenticator keys and your own API keys are encrypted at rest. The server's disk is not encrypted, so someone with full administrator access to the machine could read files on it; nothing we build can prevent that, but it would not be done through Biddable, and any change to your access log made that way would break its chain and show up in your app. Backups are encrypted.

Read our privacy notice and terms of service.