Browser-side document processing
Selectable PDF, DOCX and pasted tender text are processed in the current browser session. TenderCue does not retain the uploaded file or full pasted text in the current release.
SECURITY AND DATA HANDLING
Your tender work stays under your control.
TenderCue uses data minimisation, explicit saves, account-scoped access and browser security controls to reduce unnecessary exposure while keeping the workflow practical.
CURRENT RELEASE
- Uploaded tender and evidence files are not retained
- Full pasted tender text is not retained
- Saved work requires an explicit action
- No Evidence Vault content is sent to external AI
- Card details remain with Stripe
- Account export and deletion are available
WHAT HAPPENS TO A TENDER
Process the document. Save only the bounded work you choose.
- 1You supply authorised text or a supported file
Only use material you are permitted to access and process.
- 2The readiness check runs in your browser
The current release analyses the supplied content without sending the original tender file to TenderCue storage.
- 3You review the result
Deadlines, requirements and cautions can be incomplete or wrong and must be checked against the complete pack.
- 4You decide whether to save
A bounded snapshot, response plan, reviewed evidence-text record or Bid Studio draft syncs only after a signed-in user confirms the save.
CURRENT CONTROLS
Practical protection at each layer.
This is a plain-language summary of controls implemented in the current product, not a certification statement.
Explicit account saves
Nothing is added to the Analysis Library, Response Plans, Evidence Vault or Bid Studio merely because an analysis runs. A signed-in user chooses when a bounded result, reviewed evidence record or draft is saved.
Verified sign-in
Account access uses the hosting authentication layer or a time-limited email link. TenderCue never receives or stores the password for the user's email account.
Account separation
Saved records are queried and changed against the signed-in account's internal identifier. Identity headers supplied by a browser request are removed before the trusted session is evaluated.
Protected changes
Account-changing requests require same-origin JSON requests, bounded request sizes and mutation budgets designed to reduce cross-site and automated abuse.
Payment separation
Paid checkout and card collection are hosted by Stripe. TenderCue stores only the provider identifiers and subscription state needed to control access—not payment-card details.
WEB AND SESSION PROTECTIONS
The public service also applies defensive browser policies.
- HTTPS is required in production and Strict Transport Security is configured.
- Session cookies are HTTP-only, SameSite and secure on HTTPS.
- Content Security Policy restricts where active content and connections may come from.
- Framing is denied to reduce clickjacking risk.
- Camera, location, microphone, payment and USB browser permissions are disabled by policy.
- Private account routes are marked no-index and returned with private, no-store caching rules.
YOUR CONTROLS
Review, export or remove saved account data.
The Account page provides an export of user-facing records and a permanent account-data deletion action. Individual opportunities, rules, analyses, plans, scorecards, Evidence Vault records, Bid Studio workspaces and the business profile can also be removed through their relevant screens.
HONEST ASSURANCE
Ask a security or privacy question →No certification claims by implication.
TenderCue does not currently claim ISO 27001, SOC 2 or IRAP certification. Hosting-provider controls are not presented as certifications held by TenderCue. Security information will be updated when the architecture or independently verified assurance changes.