Your tender data and company profile are sensitive. We treat security as a product requirement, not an afterthought.
🔐
TLS Encryption
All data in transit is encrypted using TLS 1.3. We enforce HTTPS across all endpoints with HSTS headers.
🗄️
Authenticated Data Access
Every request is authenticated and authorized against your account before it touches your data. Sensitive tables are not readable without a valid, signed-in session.
🔑
Auth via Clerk
Authentication powered by Clerk — SOC2 certified, supports Google OAuth, SSO, MFA, and session management.
💳
PCI-Compliant Payments (coming with paid plans)
When paid plans launch, payments will be handled by Stripe (PCI DSS Level 1 certified) — we will never store, transmit, or log card details ourselves.
📋
SOC2 Roadmap
We are actively preparing for SOC2 Type 1 certification. Enterprise plans include additional compliance documentation on request.
🐛
Responsible Disclosure
Found a vulnerability? Email security@bidedgehq.com. We respond within 48 hours and credit responsible disclosures publicly.