Your tender data and company profile are sensitive. We treat security as a product requirement, not an afterthought.
🔐
TLS Encryption
All data in transit is encrypted using TLS 1.3. We enforce HTTPS across all endpoints with HSTS headers.
🗄️
Row Level Security
Database access is controlled by Supabase RLS policies. Users can only query their own data — enforced at the database level.
🔑
Auth via Clerk
Authentication powered by Clerk — SOC2 certified, supports Google OAuth, SSO, MFA, and session management.
💳
PCI-Compliant Payments
Payments handled by Stripe (PCI DSS Level 1 certified). We never store, transmit, or log card details.
📋
SOC2 Roadmap
We are actively preparing for SOC2 Type 1 certification. Enterprise plans include additional compliance documentation on request.
🐛
Responsible Disclosure
Found a vulnerability? Email security@bidedgehq.com. We respond within 48 hours and credit responsible disclosures publicly.