Your tenders and bids are commercially sensitive. Here is exactly how we look after them.

In place today

• ✓
  Encrypted in transitEvery connection to Biddable uses HTTPS. Plain HTTP is redirected.
• ✓
  Your data in its own storeEach customer's space has its own separate database and file store on the server. Nothing is shared between customers, and a space's documents never reach another space.
• ✓
  Industry-standard password hashingPasswords are stored only as salted hashes, never in a readable form. Sign-in codes sent by email work once and expire after ten minutes.
• ✓
  Multi-factor authentication for every userEvery sign-in needs a second factor, and every user must set one up: an authenticator app, a passkey or an emailed code. Changing security settings asks for it again.
• ✓
  Single sign-onSign in with Google Workspace, or through SAML with an enterprise identity provider such as Okta or Microsoft Entra ID. Your organisation can make it required for your team.
• ✓
  Secrets encrypted at restKeys and credentials stored by the service, such as authenticator secrets and your own API keys, are encrypted with AES-256.
• ✓
  Sign-in history and audit logEvery user can see where and when their account signed in, and account owners can see changes to members and security settings.
• ✓
  Rate limitingSign-in attempts, code requests and access applications are limited per address and per network location, so accounts cannot be guessed at.
• ✓
  Encrypted nightly off-site backupsEvery night, encrypted copies of the data are taken to a separate location, with daily, weekly and monthly copies kept and checked.
• ✓
  Hosted in the European UnionOur servers are in Germany. The encrypted backups are kept off-site in a separate data centre in the European Union.
• ✓
  Used only for your workYour documents and the outputs made from them are used only to do your work. They are never shared with another customer and are not used to train the models behind the product.
• ✓
  Yours to take awayEverything you put in and every document produced for you can be downloaded from your space. On request we export your whole space, or delete it.
• ✓
  Owned and operated by Toga EMEA FZC LLCBiddable is a product of Toga EMEA FZC LLC, United Arab Emirates. It is a hosted service: each customer has a locked space, and there is no on-premise version.

What we do not claim

Biddable does not hold a security certification such as ISO 27001 or SOC 2, and we will not say it does until it does. If your procurement process needs a specific control, a questionnaire or a data-processing agreement, say so when you apply, or email hello@biddable.ae, and we will answer it directly.

Read our privacy notice and terms of service.