Security

What happens to the bids you send

Last updated September 28, 2026

This site takes no files

The only form here asks for your first name and email address. Your bids never come through it. You send them after we've talked, in the way we agree on the call.

Your bids go into your own Bid Desk

Every firm gets its own copy of Bid Desk, with its own database and its own sign-ins. No other client's copy can reach yours. We use your bids to build yours, and nothing else.

Who can see them

Where they're kept

Supabase holds your copy's database and files. It encrypts all of it at rest (AES-256) and in transit (TLS), and keeps each copy in one region, picked when we set yours up. Tell us where yours needs to be. The app itself runs on Railway, which doesn't keep your documents: they're saved to the database.

Which outside services read them

Anthropic (Claude)
Reads the RFP and your documents, and writes drafts from the facts your team approves. Its commercial terms say it may not train models on what you send. It deletes what it receives within 30 days, and keeps a request longer only if its safety systems flag it (up to 2 years) or the law requires it. It stores data in the United States.
Voyage AI
Turns passages from your past bids into numbers, so Bid Desk can find the right answer for a new question. Its terms let it train on what it receives unless the account opts out, so your copy's account is opted out before any of your bids go in. It may process data in the United States.

Deleting it

Ask heinrich@bid-desk.us, and we delete your copy and everything in it. It's done by hand, so it's a request, and we reply within ten working days. Supabase's daily backups expire on their own, within 30 days at most depending on the plan.

What this page is based on