High-stakes work needs visible boundaries.
Last reviewed 28 August 2026
Current technical controls
Passwords use PBKDF2-SHA-256 with a unique salt. Sessions use Secure, HttpOnly and SameSite=Lax cookies. A new successful login revokes older sessions for that account. Registration, sign-in and public measurement endpoints use bounded server-side rate controls, and state-changing requests require a matching origin.
Document processing
PDF extraction happens in the member's browser. Readable text is sent to TenderSlate to create a page-cited compliance review and the resulting analysis is stored in the private workspace. The original file is not retained. The current analyzer is deterministic; tender text is not sent to a public generative-AI chatbot or used to train a model.
Human control
TenderSlate does not submit bids, contact buyers, certify eligibility or promise an award. Its Go/No-Go result is an evidence-readiness score based on the supplied company profile and extracted requirements. Users must verify the original tender, legal terms, deadlines and every proposed claim.
Certification status
TenderSlate is not currently SOC 2 or ISO 27001 certified and does not claim otherwise. Formal security certification, independent penetration testing, enterprise access controls and data-processing agreements belong to the enterprise-readiness phase after the business and infrastructure are established.
Known limitations
Scanned PDFs require OCR before upload. Tables, images, multilingual wording and legal context can be missed. Email verification and password recovery are not yet active. The current hosting quota must be removed through the planned independent Cloudflare deployment before high-volume marketing.