§ Security
Your documents. Walled off.
Built like the systems it reads: separated by client, encrypted at rest and in transit, and contractually excluded from model training. This page is the longer answer to the landing page's summary.
The posture
Encryption
Military‑grade encryption
AES‑256 at rest, TLS in transit. AES‑256 is the cipher the NSA approves for TOP SECRET material. Hosted on U.S. infrastructure.
Tenancy
A walled workspace per client
Every client is a separate, walled workspace with no cross‑tenant access, enforced at the database layer with row‑level security, not in application code alone.
Model training
Your content stays yours
AI processing runs under commercial terms that contractually exclude your content from model training.
Files
Private by default
Document storage is private; nothing has a public URL. Access happens through expiring signed links, uploads are scoped so one tenant can never write into another's folders, and every workspace is backed up daily.
Payments
Card data never touches us
Checkout and billing management are hosted by Stripe. Card numbers are entered on Stripe's pages, not ours, and never transit BidVector servers.
Scope
What it is built for
Public solicitation documents and ordinary business information; not intended for CUI.
Tested, not asserted
A policy that has never been attacked is a hope. These are checks that actually run against the live system, written so they can fail.
01Isolation is exercised with real credentials
Tenant isolation is tested by signing in as real users and attempting to reach a sibling tenant's data, not by reading policy text and hoping. A check that cannot fail is not a check.
02Every privileged function declares its reach
Each privileged database function carries a declared exposure and reason, and an automated gate calls every one of them to prove nothing is reachable by a wider role than it declares.
03Authentication links are single‑use
Email sign‑in and confirmation links spend a single‑use token; a link that has been used, or merely fetched by a scanner, cannot be replayed.
04Unauthenticated surfaces are throttled
Rate limits sit in front of authentication and the unauthenticated join‑code surface, and workspace join codes carry a minimum credential strength at creation.
05Email is authenticated
SPF, DKIM, and DMARC are published for our sending domain, so mail claiming to be BidVector can be checked against us.
Questions, disclosures, the long version
Security questions and responsible disclosures both go straight to the operator, and the full security overview is available on request.