Authentication & Access Controls
Verified identity, active membership and permissions for supported workspace actions.
TenderSNAP Trust Centre
Security built into
your workspace.
Reviewed controls include verified sign-in, organisation membership checks and server-side permissions. Explore how customer information and authorised AI processing are handled.
Security information
Find the detail you need.
Explore reviewed controls, provider-supported safeguards and areas that need further confirmation for your requirements.
Data Protection & Privacy
Understand customer information, hosting locations and the practices that still require confirmation.
Infrastructure Security
HTTPS access, a permitted-route gateway and clearly attributed provider safeguards.
AI & Customer Data Handling
What authorised analysis may send to a provider, with retention and training limits explained.
Security Architecture
A logical view of identity, customer access, application services and external processing.
Documentation & Policies
Published information and provider references, with a clear route for security enquiries.
Reviewed safeguards
How TenderSNAP protects
your workspace.
Server-side access
Active organisation membership and supported permissions are checked by the application.
HTTPS access
The public website and customer application are served over HTTPS.
Storage encryption
Railway documents encryption at rest with provider-managed keys. This is not end-to-end encryption.
AI processing checks
Supported paid AI operations check access and configured workspace allowance. Service safeguards also govern availability.
Security architecture
The architecture behind
your workspace.
Reviewed logical connectionsIllustrative request flow
Browser requests reach the Vercel gateway and customer backend. Supabase Auth supports identity verification. The customer backend connects to PostgreSQL. The OpenAI branch applies only to enabled, authorised processing.
Customer
Browser
HTTPS access to the private application.
Identity provider
Supabase Auth
Provider identity supports customer sign-in.
Application edge
Vercel gateway
Permitted routes and protected browser requests.
Application service
Customer backend
Railway-hosted services check workspace membership and supported permissions.
Data services
PostgreSQL
Application data storage on Railway infrastructure.
External processing
OpenAI
Tender text, profile context or document extracts may be processed. Provider retention and account settings require separate consideration.
Supabase identity is checked during sign-in.
The AI branch applies only to enabled, authorised workflows.
Signals show logical relationships, not live monitoring. AI processing is conditional. Document-storage permissions, malware scanning and automatic deletion periods have not been verified.
Read architecture scope and limitationsDocumentation & policies
Documentation & Policies
Search available public pages, on-page explanations and provider documentation. No unavailable certificate or report is presented as a download.
8 available references
Website Privacy
Information about website data, analytics and privacy contact.
Public pageWebsite Terms
Published website terms, not a customer DPA.
Public pageSecurity overview
Reviewed controls and the limits of this security information.
On this pageCustomer data handling
Customer information, retention and provider-location qualifications.
On this pageAI processing information
Input categories, processing permissions and provider-data limits.
On this pageSupabase TLS documentation
Provider documentation for HTTPS project APIs.
External provider documentationRailway security documentation
Provider-supported infrastructure and storage safeguards.
External provider documentationOpenAI API data controls
Provider documentation on training defaults and retention.
External provider documentationNo available references match your search. Try a different term.
Have a specific security requirement?
A customer DPA, approved subprocessor schedule, retention policy, backup/restore evidence and incident-response policy are not available as verified downloads here. Contact us to discuss the information your organisation needs.
Technical information
Read the full explanation.
Reviewed on 5 November 2026. Configuration and provider policies can change. Confirm specific requirements before relying on an assurance.
Authentication & Access Controls
Verified sign-in
Customer authentication uses Supabase. The reviewed sign-in flow checks the provider identity and email-confirmation state before establishing a customer session.
Organisation-scoped access
The server checks active organisation membership. Selecting a workspace in the browser does not grant access to it.
Roles for supported actions
The application recognises Owner, Admin, Member and Viewer roles. Permissions depend on the action and the workspace subscription; a role label in the interface is not an authorisation decision.
Protected browser requests
Customer browser sessions use secure, HTTP-only cookies. The gateway validates permitted routes and request origins, with CSRF checks for protected changes. The reviewed session implementation includes expiry, inactivity checks and server-held provider tokens.
These are application controls, not a claim of universal single sign-on, enforced multi-factor authentication or immediate revocation of every provider token.
Data Protection & Privacy
Customer information and documents
Workspace features can process company details, saved opportunities, analysis results and document content. Keep sensitive personal information, credentials and material you are not authorised to share out of uploads and prompts.
End-to-end document-storage permissions, malware scanning, storage locations and automatic deletion periods have not been verified by this review. We do not present them as assured controls. Discuss any confidential or regulated document requirements before uploading.
Retention and deletion
A fixed retention schedule for customer workspace content, a deletion-completion deadline and deletion from backups have not been confirmed for publication here. Contact us to discuss access, correction or deletion requests and applicable contractual requirements.
Providers and international processing
The reviewed infrastructure includes authentication in the UK and application/database hosting in the United States. TenderSNAP is not presented as a UK-only data-residency service. Provider agreements, transfer arrangements and the complete subprocessor schedule require confirmation for your use case.
| Provider | Identified purpose | Evidence scope |
|---|---|---|
| Supabase | Customer authentication | Project and application reviewed |
| Vercel | Website and private application gateway | Serving deployment/source identified |
| Railway | Application and database infrastructure | Hosting and volume configuration reviewed |
| OpenAI | AI processing in enabled workflows | Integration reviewed; account data settings unconfirmed |
| Stripe & Resend | Billing and transactional email | Integrations identified; processing terms need confirmation |
This is a technical service inventory, not a complete or contractually approved subprocessor list. Website analytics and demo-booking services are described in the Website Privacy notice.
Infrastructure Security
Encrypted connections and storage
The public website and customer application are served over HTTPS. Supabase documents HTTPS-only project APIs. Railway documents AES-256 encryption at rest for its platform storage, with provider-managed keys.
The storage statement is a provider-supported control, not an independent inspection of physical disks or encryption keys. Encryption in transit and at rest is not end-to-end encryption.
Server-side boundaries
The private application gateway forwards only permitted requests. Application membership and permission checks remain authoritative. We do not claim that every database table has row-level security or that the database has no public network endpoint.
Operational safeguards
Secrets are supplied through server-side configuration rather than presented as customer credentials. Backup schedules, restore exercises, recovery objectives, comprehensive audit-log coverage and an independently tested incident-response programme have not been verified for publication.
No ISO 27001, SOC 2 or CREST certification is claimed for TenderSNAP. A provider’s certification is not a certification of this application.
AI & Customer Data Handling
When an enabled, authorised AI workflow runs, relevant tender text, Company Profile context or document extracts may be included in a request to OpenAI. Results are assistance for human review, not a guarantee of eligibility, completeness or accuracy.
Processing restrictions
The reviewed application checks access and configured workspace allowance before supported paid AI operations. Availability also depends on service safeguards. A credit balance or a visible button is not proof that processing is authorised.
Training and retention are separate questions
OpenAI states that API data is not used to train its models unless a customer explicitly opts in. Its standard API controls can retain abuse-monitoring data for up to 30 days, with exceptions; retention also depends on the endpoint and enabled features.
TenderSNAP-specific data-sharing settings, a zero-retention agreement and all provider-side retention exceptions have not been independently confirmed in this review. We do not promise zero training, zero retention or UK-only AI processing.
Security Architecture
The reviewed customer application uses a Vercel gateway, Supabase authentication, Railway-hosted customer/backend services and PostgreSQL data services. The gateway restricts permitted requests; the application resolves active organisation membership and permissions for supported actions.
Identity verification and organisation authorisation are separate responsibilities. An authenticated user or a selected organisation does not, by itself, grant access to another workspace.
When enabled and authorised, AI workflows can send relevant tender text, Company Profile context or document extracts to OpenAI. The diagram does not imply that every customer request or uploaded file is sent to an AI provider.
The architecture is a logical overview of reviewed components. End-to-end document storage permissions, malware scanning, retention and backup deletion have not been verified. We do not claim universal database RLS, UK-only hosting or end-to-end encryption.
Application authentication, hosting and storage statements retain the evidence limits described in the access, data protection, infrastructure and AI sections.
Documentation & Policies
Website PrivacyWebsite information, analytics and privacy contactWebsite TermsPublished website terms; not a customer DPASecurity contact[email protected]
Documents that need confirmation
A customer DPA, approved subprocessor schedule, retention policy, backup/restore evidence and incident-response policy are not available as verified downloads here. Request the information relevant to your organisation; do not assume an unavailable document or service commitment exists.
Report a security concern
Email [email protected] with a description and safe reproduction steps. Please do not email passwords, verification links, API keys or customer documents. Contact us to agree a secure way to share sensitive evidence.
No response-time SLA or round-the-clock security monitoring commitment is published here.
Last security content review: .