Data Storage & Security Policy

This policy describes where and how TenderCopilot AI stores your data, how credentials are protected, and the security controls in place. It complements our Privacy Policy.

1. Cloud-only storage

TenderCopilot AI runs entirely on managed cloud platforms. There is no on-premise or local-machine deployment that serves users or holds production data. Your data lives only in:

• Database — Neon (PostgreSQL): account, company profile, tenders, scores, proposals, pipeline and billing records. Encrypted at rest and in transit (TLS).
• Object storage — Cloudflare R2: uploaded documents, stored in a private bucket with no public access. Encrypted at rest.
• Compute/CDN — Vercel: runs the application; static assets served from the edge.

2. Password storage

• Passwords are hashed server-side; the raw password is never written to disk or logs.
• Each user has a unique random salt, so identical passwords produce different hashes.
• Password verification uses a constant-time comparison to resist timing attacks.
• Minimum policy: at least 8 characters including a letter and a number.
• If you sign in with Google or Microsoft, no password is stored at all — authentication is delegated to that provider via OAuth 2.0 / OpenID Connect.

3. Username / identity storage

Your identity is your email address, which is stored as a unique record. Your display name and (for OAuth) profile image are stored to personalise the app. We do not store government IDs as your login identity; GSTIN/PAN are stored only as business profile fields for eligibility checks, not as credentials.

4. Encryption

• In transit: TLS 1.2+ is enforced end-to-end across the app, database, and storage.
• At rest: the database and object storage encrypt data at rest by default.
• Secrets: API keys and provider credentials live only in the hosting platform’s encrypted environment store — never in the codebase, never shipped to your browser, never logged.

5. Access to documents

Uploaded documents are private. They are never publicly addressable. When you upload or download a file, the server issues a short-lived, single-purpose pre-signed URL (valid for at most five minutes) scoped to that one object. Files are stored under non-guessable, tenant-prefixed keys.

6. Tenant isolation

Every record is scoped to your organization. Authorization is re-checked server-side on every request from your authenticated session — the identifier of your company is derived from your session, never from client input — which prevents one customer from accessing another’s data.

7. Authentication & sessions

• Sign-in via Google, Microsoft, or first-party email/password.
• Sessions use signed, HTTP-only, Secure cookies with a short lifetime.
• AI-invoking endpoints are rate-limited to prevent abuse.

8. Audit logging

Significant actions — document access, proposal generation, outcome recording, account changes — are recorded in an append-only audit log for security and accountability.

9. Payment data

Payments are processed by Razorpay. Card numbers, UPI IDs and banking credentials are entered on Razorpay’s secure checkout and are never stored on our systems; we retain only the transaction reference and status.

10. Data deletion

Deleting your account permanently removes your account and your organization’s data from the database within the deletion transaction. Backups age out on the platform’s standard cycle. Deactivation is reversible and retains your data until you sign in again.

11. Reporting a vulnerability

If you believe you have found a security issue, please contact support@tendercopilot.in. We appreciate responsible disclosure and will acknowledge your report promptly.