Security Policy

Keendex is committed to protecting the confidentiality, integrity, and availability of all information processed through the platform. Our security practices are designed to protect your data throughout the full tender workflow — from document upload through extraction, compilation, and submission.

• All customer data — including uploaded tender documents, extracted outputs, company metadata, and briefcase documents — is treated as confidential.
• Access to customer data within Keendex is governed by role-based access controls. Platform roles (Admin, Member, Viewer) restrict access based on permissions assigned by the account Admin.
• Keendex internal staff access to production data is restricted to authorised personnel only, on a need-to-know basis.
• Access approvals, employee confidentiality obligations, and periodic access reviews are maintained.

• All data transmitted between your browser and Keendex is encrypted in transit using TLS (Transport Layer Security).
• Stored data, including uploaded documents and extracted outputs, is encrypted at rest where applicable.
• Company metadata stored in the Metadata Repository and Briefcase is encrypted and isolated per account.

The following technical guarantees apply:

• AES-256 encryption standard: all bid data is encrypted using AES-256, the same 256-bit key standard used by banks, governments, and defence organisations worldwide.
• PBKDF2 key derivation: the user's chosen password is processed through PBKDF2 to derive a strong 256-bit cryptographic key, making dictionary and brute-force attacks significantly harder.
• Password-only decryption: only the user who holds the correct encryption password can access the plain-text bid data. No access exists for any other party — including Keendex platform administrators.
• Tamper-proof storage: any modification to any stored encrypted data is instantly detectable. Data integrity is cryptographically guaranteed end-to-end.
• Zero visibility by default: all encrypted bid data is invisible to all parties. Content surfaces only to the authorised user who holds the correct decryption key.

• Each user's uploaded documents and extracted outputs are logically isolated from other accounts.
• AI processing of tender documents, BOQ files, and annexures is performed in a secure, isolated environment.
• Page references and extraction audit trails are maintained so every AI output can be traced back to its source document.
• Customer documents are not used to train public AI models.

• Keendex is hosted on reputable cloud infrastructure providers that maintain industry-standard physical and environmental security controls.
• Automated backups of platform data are performed regularly to enable recovery in the event of data loss.
• Disaster recovery and business continuity procedures are documented and periodically tested.
• Vulnerability scanning and periodic security assessments are conducted to identify and remediate risks.
• Secure development practices are followed in the design and deployment of platform features.

• Platform activity — including extraction operations, login events, and API calls — is logged and monitored for anomalous behaviour.
• Security incidents are identified, triaged, contained, and remediated through a documented incident response process.
• In the event of a data breach affecting your information, we will notify affected users in accordance with applicable legal requirements.

Keendex uses third-party providers for cloud hosting, AI model processing, payment handling, and analytics. All providers who handle customer data are assessed using commercially reasonable due diligence and are bound by contractual data protection obligations.

TenderTiger integration involves connecting your TenderTiger credentials to Keendex for tender discovery. This integration is governed by the security practices of both platforms and your authorisation to connect the accounts.

Security is a shared responsibility. You can help protect your Keendex account by:

• Using a strong, unique password and keeping your login credentials confidential.
• Managing team member access carefully — assign the minimum role (Admin, Member, or Viewer) necessary for each user's responsibilities.
• Revoking access for team members who no longer require it.
• Notifying us immediately at support@keendex.com if you suspect unauthorised access to your account.
• Ensuring that documents uploaded to Keendex are authorised for processing and do not contain malicious content.

If you discover a security vulnerability in the Keendex platform, we encourage you to report it responsibly. We will investigate all credible reports in good faith and aim to resolve validated issues promptly. We ask that you do not publicly disclose any vulnerability until we have had a reasonable opportunity to investigate and remediate it.