Security and support
Bid Environment holds your tender documents, your company's details and sometimes your directors' information. This page explains how it's kept safe and how to reach us.
Where your data is kept
- Your register (the database) is kept in South Africa, with our hosting provider, Oner.
- Documents you upload are stored in South Africa, with Microsoft Azure in Johannesburg, and are encrypted at rest by Azure. They are never public: every download goes through the app, which checks that you're a signed-in member of the company they belong to.
- Each company's register is private and kept separate from every other company's.
- On the Team plan you can keep your files in your own Microsoft 365 or Google Drive instead. The app can only reach its own Bid Environment folder there, not the rest of your drive.
Signing in
- Sign in with Microsoft or Google, or with a password, which we store only as a one-way hash.
- Two-step login with an authenticator app. It's required for Admins.
- After 10 failed attempts on one account, or 30 from one address, within 15 minutes, further logins are blocked until the 15 minutes are up.
Who can see what
- Only the people your company invites.
- Four roles (Admin, Manager, Contributor, Viewer), each seeing what the role needs.
- Every tender keeps a history of its changes. On Pro and Team, a company-wide activity log records who changed what, and when.
Protecting sensitive details
- Every connection uses HTTPS.
- Two-step login secrets, connected-mailbox and file-storage tokens, and directors' ID numbers are encrypted. ID numbers are shown masked; the full number appears only on a form an Admin or Manager generates.
The tender reader
When a tender PDF is read (you choose Read to fill in, or it's the first document on a new tender), its text is sent to Anthropic, in the United States, to find the dates and returnables. That text can include names that appear in the tender itself, such as the issuer's contact person. When the app fills in an SBD/MBD form, the form's pages and your company details (registered name, registration, tax, CSD and B-BBEE details) are sent too. The names, ID numbers and contact details in your bid profile are never sent; they are written onto the form on our own server. Everything the reader fills in shows the page it came from, and stays "not checked" until someone on your team confirms it.
Backups and availability
The server is backed up daily, to Microsoft OneDrive in South Africa, on a rolling schedule. A deleted document can be recovered from storage for 14 days, then it is gone. We can't promise the service will never be interrupted, so keep your own note of critical closing dates.
Leaving
An Admin can download all of the company's data at any time from the Billing tab. Deleting the company locks the register at once and erases it, documents included, after 30 days.
If something goes wrong
If a breach affects your personal information, we'll tell you and the Information Regulator, as POPIA requires. Our Information Officer, Vusi Cossa, is registered with the Information Regulator (registration 2026-038912).
Reporting a security problem
Email [email protected] with "Security" in the subject line. Please don't test against other companies' registers. Our security.txt has the same details.
Support
Email: [email protected] · Phone: 072 304 5533 · WhatsApp: 072 304 5533
We answer Monday to Friday, 09:00 to 17:00. The app itself is open any time. Book a 15-minute demo.