Security
BidQ is built for sensitive procurement work. RFPs, bid documents, pricing files, evaluator notes, and award decisions often contain confidential commercial and government information, so the platform is designed to protect documents, users, and evaluation activity throughout the procurement workflow.
Document security
BidQ stores uploaded RFPs, amendments, vendor proposals, cost files, and supporting documents in controlled cloud storage. Files are handled through authenticated application flows, not public links. Access to documents is tied to the user’s workspace and role, so users only see procurement records they are allowed to access.
Uploaded documents are used for extraction, scoring, comparison, and audit support. They are not exposed to other customers or workspaces.
Access control
BidQ uses secure login and workspace-based access control. Users are assigned roles such as owner, admin, evaluator, or reviewer. These roles control what a person can upload, edit, review, approve, export, or delete.
For example, evaluators can be assigned only to specific criteria, while owners and admins can manage RFP settings, compliance checklists, evaluator assignments, and award approvals.
Authentication and 2FA
BidQ supports centralized authentication through Keycloak and can enforce multi-factor authentication. This helps protect accounts even if a password is compromised.
Session access is controlled through authenticated tokens, and protected API endpoints require valid user authentication before returning procurement data.
Workspace isolation
Each organization or workspace is separated from others. RFPs, bids, comments, audit logs, billing records, and user activity are scoped to the correct workspace. This prevents one customer’s procurement data from being visible or accessible to another customer.
AI processing safety
BidQ uses AI to extract requirements, evaluate bids, identify risks, compare pricing, and summarize evidence. AI outputs are treated as review support, not automatic final decisions.
Human reviewers remain in control of compliance decisions, scoring review, overrides, approvals, and final award actions. The platform highlights citations, weak evidence, exceptions, and risks so reviewers can validate the reasoning before relying on it.
Audit trail
BidQ records important procurement actions such as uploads, evaluations, compliance decisions, reviewer activity, score changes, overrides, bid deletion, and award approval steps.
This helps teams explain what happened, who acted, and when decisions were made.
Billing and payment security
Payments and subscription management are handled through Stripe. BidQ does not store raw card details. Billing flows use Stripe-hosted secure payment infrastructure.
Operational security
BidQ runs on cloud infrastructure with separate API and worker services. Background document processing is handled through durable job queues so uploads and evaluations can be retried safely if processing is interrupted.
Production services use controlled environment variables and secret management for sensitive credentials such as API keys, database credentials, and payment secrets.
Data protection commitment
BidQ is designed to support real procurement teams by protecting confidential bid data, maintaining workspace separation, keeping human reviewers in control, and preserving auditability across the evaluation process.