Private evidence storage
Certificates and bid documents sit in a private bucket. Downloads are signed and expire; files are never exposed as public URLs.
Security and trust
Your evidence stays yours.
Bid documents contain pricing, certifications and client references. Bidder is built so that information is isolated, traceable and never submitted anywhere without a human decision.
Organization-level isolation
Postgres row-level security scopes every company profile, document and workspace to its organization. A second tenant cannot read your records.
Human approval by design
Generated packages are watermarked drafts. Bidder does not sign declarations, set final prices or submit bids on GeM.
Account security
Email OTP verification and password authentication through Supabase Auth. Sessions are scoped to your organization and role.
Minimised processing
Tender PDFs are parsed for clauses. We store the source document and extracted requirements, not a free-form copy of your entire bid history.
Export and deletion
You can export your packages and ask us to delete your organization's data. Backup copies expire on our retention schedule.
Where your data lives
Bidder runs on Supabase for authentication, Postgres and private object storage. The web application is served from a managed Node hosting provider. Transactional email is delivered through a dedicated email provider, and payments — once enabled — are processed by Razorpay. We do not sell customer data.
Access and roles
Organization owners and admins manage company evidence. Reviewers can inspect bids and packages. Platform access to customer data is limited to support and operations staff with an audited need.
GeM independence
Bidder is an independent service and is not affiliated with Government e Marketplace or the Government of India. We do not guarantee eligibility or a tender award. The authorised representative remains responsible for verification and submission.
Reporting a concern
Email contact@bidharbor.online for security questions or to request a data processing addendum.
Need a security review before your pilot?
We can share our data map, subprocessors and retention policy.