Security
Your credentials, your documents, your control
Tender documents are among the most sensitive files a company holds. Grovia Tender is built so that only your organisation can see them, every access is logged, and nothing leaves without a human decision.
Tenant isolation
Every record belongs to one organisation. Data access always goes through a tenant-scoped database client, and the isolation is covered by automated tests generated from the schema itself.
Encryption
TLS for everything in transit. Documents and database storage encrypted at rest. Provider keys and secrets stored encrypted, never in code.
Signed, short-lived URLs
Documents live in a private bucket. Every download and upload uses a short-lived signed URL issued only to an authenticated member of your organisation.
Role-based access
Owner, Admin, Proposal Manager, Technical, Finance, Legal and Viewer roles with a capability matrix. Invite people to see only what they need.
Audit logs
Who did what, when, from where, for every sensitive action: logins, document access, approvals, role changes, exports.
Malware scanning and limits
Uploads are scanned, rate limits guard the API, and sessions can be protected with multi-factor authentication.
No automatic submission
There is no code path that submits a tender response, signs a document or approves pricing. The final pack is built only after your explicit approval.
Your data is never used for training
Your documents, proposals, prices and notes are private to your organisation and never used to train AI models. The one thing that joins shared market data is the bare award fact when you record a loss on a public tender (who won, for how much), without your name, and you can switch that off.
Auditable AI
Every AI call is metered, logged and linked to the output it produced. Outputs that cannot be verified against a document are flagged for review, never stored as fact.
Data handling
Where your data lives and how it moves
- Hosting
- Grovia Tender runs on Webzworld infrastructure with its own database, storage bucket and processes, independent of every other Webzworld product. Data is stored in the Asia-Pacific (Mumbai) region.
- Tender sources
- Public portals (CPPP and state e-procurement portals), read openly by an identified reader that honours robots.txt and never goes past a login or CAPTCHA (see the portal reader policy); documents you upload; alert e-mails you forward; and your own feed keys.
- AI providers
- Documents are sent to AI providers only to perform the analysis you request, over encrypted connections, under terms that prohibit training on your data. A private AI deployment for Enterprise customers is on the roadmap and available on request.
- Retention and export
- Your data stays for as long as your account exists. E-mail info@groviatender.com to request an export of your documents and proposals, or to close the organisation; we act within 2 working days.
- Backups
- Encrypted daily backups of the database and storage, restorable per product.
- Reporting an issue
- Email info@groviatender.com with “security” in the subject line. We acknowledge within one working day.
Formal certifications (for example ISO 27001) are not claimed at this time. This page will be updated as third-party assessments are completed.
Want the details before you upload anything?
We are happy to walk your IT or legal team through the architecture.