Security and data protection

Procurement records are evidence. Tenderscape is built so they’re complete, attributable and protected, and so your information governance review is straightforward.

Book a demo

What your IT and information governance teams will see

Only what is true today is marked as available. Anything that depends on your set-up, or is still to come, says so.

Available now

In the product today.

Two-step sign-in for approvers and administratorsIn place: Enforced for the admin area, award approval and call-off awards.
Approval limits and separation of dutiesIn place: Enforced in the database and checked automatically on every change.
Responses sealed until the closing timeIn place: Enforced in the database, with a time-stamped receipt for each supplier.
Audit log that can’t be editedIn place: Each entry is chained to the one before, so a change would be detectable.
HostingDublin, Ireland: UK data protection law treats Ireland as adequate, so no extra transfer safeguards are needed for hosting there.
Sub-processors publishedIn place: Listed on this page and the data protection page.

Set up with you

Depends on your organisation’s set-up.

Microsoft Entra ID sign-inAt set-up: Tested with your own tenant before the pilot starts.

Planned

Labelled with when it will be in place.

AI writing assistanceBefore your pilot: Off by default. Its provider is added to the sub-processor list before anyone can switch it on.
Data processing agreement and DPIA supportBefore your pilot: Template and support for your data protection impact assessment.
Cyber EssentialsBefore your pilot: Certificate shared with your IT team when issued.
Full data export and exit planBefore your pilot: Tested with you during the pilot, including documents and the audit trail.
Accessibility (WCAG 2.2 AA)Audit planned: Statement published on our accessibility page. An independent audit is planned.
ISO/IEC 27001:2022Written to it: Not certified – our security management system is written to it.

Single sign-on: Public-body staff sign in with Microsoft (Entra ID), and your administrator can require it. Suppliers use a passkey or their email and password.
Passkeys: Supported for every account, including suppliers.
Two-step sign-in: Required for the admin area, award approvals and call-off awards, and for platform administrators.
Roles: Eight roles, each limited to what that job needs: Procurement officer (creates quotes, invites suppliers, prepares awards), Approver (approves or returns quotes and awards within a set limit), Evaluator (declares conflicts and scores responses after the closing time), Finance analyst (spend, contracts and reports), Call-off manager (raises and awards repair call-offs), Report signatory (signs off an annual procurement report they did not prepare), Organisation administrator (users, roles, sign-in, settings and the audit log) and Supplier (its own profile and responses only). Every action is checked on the server against the person’s role.
Organisation separation: Each organisation’s data is separated at the database level and covered by automated isolation tests.

Records and audit

Audit log: Changes are recorded with who made them and when. Entries can’t be edited or deleted.
Tamper evidence: Each entry is chained to the one before, so a change to a past entry would be detectable.
Evaluation integrity: Scores, moderation and approvals are kept with the reasons given at the time.

Hosting and data

Location: The application and database run in data centres in Dublin, Ireland. UK data protection law treats Ireland as adequate, so no extra transfer safeguards are needed for hosting there.
Encryption: Data is encrypted in transit and at rest.
Your data out: Your administrator can download every record, the audit log and every document at any time from Settings › Data export. Annual report drafts can be downloaded at any time; the final files are released once the report is signed off. Read-only Power BI access can be set up during the pilot.
Data protection: Lanayr Ltd processes personal data on your behalf as a processor. We’ll agree a data processing agreement with you before you go live, and we can send our template and support your data protection impact assessment on request.
Retention: Each public body sets retention for its records; the default is 6 years after the contract ends, or 6 years after the decision if no contract is awarded. When a public body’s Tenderscape contract ends, we return its data and delete it within 90 days, as set out in Leaving Tenderscape.
If you leave: Leaving Tenderscape: full export, deletion and continuity.

Sub-processors

Vercel Inc.: Hosts the application, which runs in Dublin.
Supabase Inc.: Database and file storage, in Dublin.
Resend: Sends email notifications from Ireland (EU) once email is switched on; notices go to an outbox until then.
HubSpot: Our CRM: enquiries and sign-ups from this website, and our sales records; hosted in HubSpot’s EU data centre.
Sentry: Error monitoring for the application. Error reports are stored in Frankfurt, Germany, with email addresses, cookies and request contents removed before they are sent.
Transfers: Some of these providers are US companies. Where data leaves the UK, it is protected by the UK International Data Transfer Addendum or the UK–US data bridge.

Standards

Information security: Our information security management system is written to ISO/IEC 27001:2022. Certification is planned, and we’ll share our policies on request.
Cyber Essentials and penetration testing: Cyber Essentials certification before any live council data is processed. An independent penetration test before production go-live (26/02/2027), with the summary report shared with customers.
Accessibility: Designed to meet WCAG 2.2 AA
Reporting a security issue: Email security@tenderscape.co.uk. Our security.txt file is at /.well-known/security.txt.

Accounts and access

Your organisation administrator invites staff and gives each person a role and an approval limit. Public-body staff sign in with Microsoft (Entra ID), and your administrator can require it for everyone in your organisation. Suppliers sign in with a passkey or their email and password. When someone leaves, your administrator removes them and their access ends straight away. Your administrator restores lost access – Tenderscape staff never reset a public-body user's sign-in.

If something goes wrong

If we confirm a security incident that affects your data, we tell your named contact without undue delay and within 24 hours, share what we know, and help you meet your own 72-hour reporting duty to the ICO. To report a security issue, email security@tenderscape.co.uk.

Backups and recovery

The database is backed up every day and backups are kept for at least 7 days. Every quarter we restore a backup to a test environment and record the result.

Assurance status

Assurance status
Item	Status today	Next step
Cyber Essentials	Not yet certified	We are preparing for Cyber Essentials certification.
Independent penetration test	Not yet done	We will commission a test from a CREST-accredited company before the first pilot, and share a summary under a non-disclosure agreement.
ISO/IEC 27001:2022	Not certified – our security management system is written to it	Certification is planned.
Accessibility (WCAG 2.2 AA)	Not independently audited	See our accessibility statement.

Last reviewed: 19/10/2026

Assurance pack

We send our security and data protection pack on request: policies, data flow, sub-processors and the template data processing agreement. Email security@tenderscape.co.uk.

Data protection, sub-processors and the agreement · Leaving Tenderscape

Assist (AI writing help)

Assist is off by default. It stays off during pilots until we publish the model provider, processing location and retention terms and your information governance team approves.

Before a pilot we provide a written assurance pack covering support hours, incident response, backup and restore, continuity and exit. Ask for it when you book a demo.

Need answers for your information governance team?

We’ll walk your IT and information governance colleagues through how Tenderscape handles your data.