Trust & security
How BizRadar protects your organization's files and data, in plain words, including what isn't done yet.
Indrasol, the company that builds and runs BizRadar, is certified to ISO/IEC 27001:2022, the international standard for information security management.
How a file is protected
Solicitations (RFP, RFQ, RFI), responses, pricing and attachments: every file, every time.
- 1
A new key for every file
You upload a file. Our server creates a brand-new random key just for that file and encrypts the file with it (AES-256-GCM, the same standard banks use).
- 2
Locked with your organization's key
That file key is then locked with your organization's own master key, which lives in Microsoft Azure Key Vault and never leaves it.
- 3
Only scrambled bytes are stored
Only the encrypted file is stored. Someone with access to storage alone sees scrambled bytes.
- 4
Opened only for permitted members
When a permitted member of your organization opens the file, the server checks their role, asks Key Vault to unlock the file key, decrypts in memory and streams it to them. Every open is logged.
- 5
Gone for good when you leave
If you leave, we delete your master key. Key Vault keeps a deleted key recoverable for 90 days, then every file is permanently unreadable.
Sign-in
You sign in with Microsoft or with a one-time email code. We never see or store your password. With Microsoft, your company's Microsoft security rules still apply.
Two-step verification
Anyone can add an authenticator app, plus a backup, under Account › Security. Owners choose who must use it: owners and admins, everyone, or chosen people. The server and database then refuse data to those people until they verify.
Organizations and roles
Every private record belongs to one organization, and the database itself enforces that one organization can never read another's. Each account belongs to one organization. Four roles (owner, admin, member, viewer) decide who can change what, and restricted items stay private even from admins unless they use audited admin access.
Audit log
File opens and downloads, decisions, member and setting changes, and key operations are recorded in a log that can't be edited. Owners and admins can review it.
What an AI assistant can and cannot do
An AI assistant reaches BizRadar only through the connector a person adds to their own assistant account and approves.
It can
- Search and read opportunities, awards and partner data
- Read solicitations your organization has added, section by section
- Add solicitation documents and update the compliance matrix
- Record watch, pursue and pass decisions in your name
It cannot
- Change members, roles or security settings
- See another organization's data. It acts as you, in your organization, with your role
- Reach anything the person using it couldn't reach in this console
- Act without a record: every action is in your organization's audit log, marked “AI assistant (via BizRadar connector)”
Portal alerts
Portal alerts are private to the organization whose alert address received them. We keep the alert's details (sender, subject, the bids it names) and an excerpt of up to 2 KB of its text, never the full email. The raw email is deleted from our alert inbox after 30 days. No person is a member of that inbox, and operator access to the database is limited to named staff and logged.
Where your data lives
- Application, files and keys
- Microsoft Azure, East US: the BizRadar servers (Azure Container Apps), encrypted file storage (Azure Blob Storage) and your organization's master key (Azure Key Vault).
- Database
- Supabase (managed Postgres, on AWS): US East (N. Virginia, us-east-1) for the project in use today; the production region is confirmed before launch.
Retention and deletion
- Your files and records are kept while your organization uses BizRadar.
- Deleted or overwritten files stay recoverable for 30 days (storage versioning and soft delete), then are gone.
- When an organization leaves, its master key is disabled and then deleted. Key Vault keeps a deleted key recoverable for 90 days (purge protection); after that every file it stored is permanently unreadable (crypto-shredding), including copies in storage history.
- Final proposal versions are write-once: they can't be changed or deleted until their retention period ends, even after an organization leaves. Once its master key is gone they can't be opened.
- The audit log can't be edited or deleted while your organization exists. Server logs are kept 30 days.
- The database is backed up daily by Supabase.
Sub-processors
The companies whose services hold or process your organization's data.
| Company | What for | Where |
|---|---|---|
| Microsoft Azure | Hosting of the API and AI connector, encrypted file storage, key management (Key Vault), logs, email sending (Azure Communication Services) | United States (East US) |
| Netlify, Inc. | Hosting and delivery of the website and console (your files and records stay in the API on Azure) | United States |
| Microsoft 365 (Exchange Online) | Receiving portal alert emails at our alert addresses | United States |
| Supabase | Database and sign-in (sign-in codes are emailed through Supabase's email provider) | United States (us-east-1) |
| AI assistant providers (Anthropic, OpenAI, Microsoft, Google) | Only when your organization connects that assistant: it receives only what a signed-in person's own session asks for. Our servers never send your data to an AI model. | Per your assistant plan |
| Connectors your organization turns on (for example Microsoft Teams, TasKadence) | Only the notifications or tasks your organization chooses to send there | Per that service |
Planned security work
Other organizations can now sign up. These items are on our security checklist and are not done yet. We will mark each one here when it is.
- PlannedMalware scanning of uploads before they are encrypted
- PlannedAn independent penetration test
- PlannedA web application firewall (WAF) in front of the console and API
- PlannedPrivate networking between the servers and the database
- PlannedTesting the crypto-shred procedure against the production key vault
Found a problem or have a security question? Email security@indrasol.com.
Also read our Privacy policy, Terms of use and Support page.