Your data is encrypted in transit. Stored documents are encrypted at rest. Each customer's data is kept separate from every other customer's, and access is limited to what's needed to run the service.

Incident response

In the event of a confirmed data breach affecting subscriber data, BidClarity will notify affected subscribers by email within 72 hours of becoming aware of the incident, as required by applicable privacy law. Notifications will describe the nature of the incident, the categories of data affected (including whether Fulfill contract or supplier records are involved), steps taken, and any actions recommended for subscribers. Security incidents can be reported to security@bidclarity.ai.

Security certifications

BidClarity does not currently hold SOC 2, ISO 27001, or FedRAMP certification. Our security programme is aligned with ISO 27001: we keep a risk register and a Statement of Applicability against its controls. We are committed to transparency about our current posture. If your organisation requires a specific compliance certification for vendor approval, please contact us at hello@bidclarity.ai to discuss your requirements.

Responsible disclosure

If you discover a security vulnerability in BidClarity, please report it to security@bidclarity.ai with "Security" in the subject line. We aim to acknowledge every report within 2 business days, and aim to resolve valid reports within 30 days. We ask that you do not publicly disclose vulnerabilities before we have had the opportunity to address them. We do not currently offer a formal bug bounty programme but will acknowledge contributors in our security changelog.

Questions

For any security-related question: hello@bidclarity.ai. We respond within 1 business day.