Trust & security
Your bids are your business. Here is how we keep them that way.
The controls below are the ones built into Tendgine today, described plainly. We track them against the SOC 2 Trust Services Criteria; an independent audit has not been completed yet.
SOC 2 aligned · Audit pending
Customer data stored in Canada
Last reviewed October 8, 2026
Controls
Built into the product.
Access
Who can sign in, and what each person can see and change.
Two-step sign-in
- Authenticator-app codes with one-time recovery codes
- Administrators can make it mandatory for everyone in their company
- Five wrong codes in a row pause sign-in for 15 minutes
Passwords and sessions
- Passwords are hashed with bcrypt and must meet a strength policy
- Sign-in attempts are rate-limited, and failed attempts are logged
- Sessions use httpOnly cookies; access tokens last one hour and sessions renew for at most seven days
Role-based permissions
- Administrator, sales and read-only roles
- Each company can tune its own permission matrix, screen by screen and action by action
Data isolation
Company A never sees or changes company B's data.
Company-scoped by design
- Every record belongs to one company, and every request is scoped to the signed-in user's company
- Another company's records are answered as not found, so their existence is not revealed
- New records take their company from the server, never from what the browser sends
- Database row-level security blocks direct public access to every table
Encryption
Protection for data on the move and at rest.
In transit
- HTTPS everywhere, enforced with HTTP Strict Transport Security
- Content Security Policy, clickjacking and content-type protections on every page
At rest
- Database and file storage are encrypted at rest by our hosting providers
- Two-step sign-in secrets and connected texting keys are encrypted by the application
- Company email secrets can be held in Azure Key Vault rather than the database
Monitoring and recovery
Knowing what happened, and getting files back.
Audit trail
- Sign-ins, failed sign-ins and changes are recorded with who, what and when
- Company administrators can review the log in the app
- Audit records are kept for two years
Error monitoring
- Errors are reported to our monitoring service with emails, tokens and keys redacted from log messages
- Browser error reports do not include IP addresses or cookies
Backups
- Uploaded files are copied daily to Azure Blob Storage in Canada Central
- A monthly drill checks that the backup can actually be restored
Secure development
How changes reach production.
Every change is checked
- More than 2,000 automated tests run on every change, including tenant-isolation tests
- A dependency vulnerability audit must pass before the backend can deploy
- Automated dependency updates in both codebases
Abuse protection
- Rate limits on sign-in, password reset and public forms
- reCAPTCHA on sign-in, password reset and public forms when enabled
- Incoming webhooks are verified before they are read
Data residency
Stored in Canada.
Your database, uploaded files, application servers and file backups are all hosted in Canada: Supabase on AWS in Montreal and Microsoft Azure in Canada Central.
What leaves Canada, and why
- AI providers (Anthropic, OpenAI) receive the text excerpts needed for each AI task. Their API terms commit to not training on that content.
- Error monitoring (Sentry) receives error reports with emails, tokens and keys redacted.
- Map geocoders receive business addresses and tender locations only, no names or contact details.
- Google receives bot-protection signals on public forms and, after cookie consent, website analytics.
This is our cross-border disclosure under PIPEDA. The full list is below.
Sub-processors
Who helps us run Tendgine.
Each one receives only what its job needs. Agreement details are in our Data Processing Agreement.
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase | Database and file storage | Canada (AWS Montreal) |
| Microsoft Azure | Application hosting and file backups | Canada Central |
| Anthropic | AI drafting, triage and scoring; does not train on submitted content | United States |
| OpenAI | Search embeddings and AI fallback; does not train on submitted content | United States |
| Microsoft 365 (SMTP) | Outbound email | Per company email configuration |
| Sentry | Error monitoring, with redaction | United States |
| GitHub Actions | Build pipeline and backup scheduler; source code only, no customer data | Microsoft Azure-backed |
| Google (reCAPTCHA and Analytics) | Bot protection on public forms; website analytics only after cookie consent | United States |
| Mapbox | Map geocoding of business addresses (when configured) | United States |
| Nominatim (OpenStreetMap Foundation) | Map geocoding fallback | United Kingdom and Netherlands |
| Quo (formerly OpenPhone) | CRM texting, only for companies that connect it | United States |
| ZeroBounce | CRM contact email verification, only for companies that connect it | United States |
Retention
Kept only as long as needed.
A daily maintenance job removes records once their period ends.
- Audit log
- 2 years
- AI request log (cost and quality monitoring)
- 6 months
- AI correction history
- 1 year
- Expired or completed share links (feedback, review and reference requests)
- 90 days after completion or expiry
- Rejected or unactioned tenders in the RFP Hunter
- 6 months
- Your company's proposals, CRM and library
- While your subscription is active; deleted within 90 days of termination, as our DPA commits
Your data
Yours to take, yours to delete.
Full export
We export all of your company's data, including file links, on request.
Deletion on request
We delete a company's data, including stored files, when asked, and within 90 days of termination.
Email opt-out
Recipients can unsubscribe, and a do-not-email list is checked before email goes to anyone outside your team.
People decide
AI output is a suggestion. Your team reviews and decides what is submitted.
Read the full Privacy Policy, Terms of Use and Data Processing Agreement.
Report an issue
Found something? Tell us.
If you believe you have found a security vulnerability, email us with “Security” in the subject line and the details needed to reproduce it. Please do not access other people’s data or disrupt the service while testing.
info@medallionintelligence.comIf something goes wrong
If a breach affects your personal data, we notify your company without undue delay and within 72 hours of becoming aware of it, with what happened, who is affected and what we are doing about it.
Security questionnaires
We’re happy to complete your vendor security questionnaire and share our current SOC 2 readiness status.