Security
TenderGraph aggregates public data, but your account, your targeting profile and your bid pipeline are yours. Here is precisely how they are protected — and where the honest limits are.
Accounts and sessions
Passwords are hashed with a modern password KDF and never stored or logged in the clear. Sessions are HTTP-only, same-site cookies over HTTPS. We never email you a password.
API keys
Keys are stored as SHA-256 hashes — we cannot recover one, only show it once at creation. Every key is scoped (read or write), rate-limited per minute, revocable instantly, and tied to your subscription: it stops working when the subscription does.
Payment data
Card details go straight to Stripe and never touch our servers. We hold a Stripe customer reference and the subscription status, nothing more.
Outbound requests
The platform fetches URLs that come from external notices and from the websites you give us during onboarding. Every one of those requests is validated against private and internal address ranges — including the IPv6 forms that translate to them — re-validated on every redirect, and pinned to the address we checked, so a hostile source can't steer us at internal infrastructure.
Document handling
Tender documents are downloaded under a hard byte ceiling and parsed with scripting and eval disabled, so a malicious PDF has nothing to execute.
AI features
AI runs only when you ask for it — business research during onboarding, and document summaries on request. Nothing is summarised automatically, spend is capped daily per user and platform-wide, and content sent to the model provider is not used to train models.
API keys, and where not to put them
Keys are stored as a SHA-256 hash — we cannot show you a key again after it is created, only revoke it. Some AI clients cannot send a header, so the endpoint also accepts a key in the URL. That is a deliberate compromise and it has a cost: URLs are written to access logs and proxy logs in a way headers are not. Prefer the header wherever your client supports it (OAuth sign-in, which avoids handling a key at all, works with Claude and ChatGPT), treat a key-in-URL endpoint as a secret, and rotate it if it has been pasted anywhere shared.
Data location and sub-processors
The application, the database and the ingest worker all run in London. A security questionnaire will ask who else touches the data, so it is here rather than behind an email:
- Vercel — hosts the website, the API and the MCP server (London region).
- Neon — runs the Postgres database that holds accounts and the notice store (AWS London region, eu-west-2).
- Fly.io — runs the ingest worker that collects public notices, and holds the database credentials it needs to write them (London).
- Stripe — takes payments and manages subscriptions and invoices; card details go straight to Stripe.
- Resend — sends account email and the daily digest.
- Anthropic — runs the AI features you trigger: business research during onboarding, and document summaries.
Some of these are US companies; how transfers outside the UK are safeguarded is set out in the privacy policy.
Reporting a vulnerability
Email hello@tendergraph.ai with the details and how to reproduce it. We will acknowledge within two working days and keep you posted until it is fixed. Please give us a reasonable window before publishing, and don't run tests that degrade the service or touch other customers' data — we won't pursue anyone who reports in good faith within those bounds.
We are not currently certified to ISO 27001 or SOC 2, and we say so rather than implying otherwise. If your procurement process needs a security questionnaire completed, email us and we will fill it in properly.