Security & Trust

This page is maintained by ProcureHQ Pty Ltd to answer common security and privacy questions about the ProcureHQ Tender Evaluator. It describes controls that are currently in place; it is not an independent certification or audit report. Security is a shared responsibility between ProcureHQ, our infrastructure providers, and the Customer Organisation that controls its account and its users.

1. Hosting & Data Residency

1.1 The ProcureHQ Platform runs on Lovable Cloud (built on Supabase and Cloudflare) with the primary database and object storage located in the Sydney, Australia region (AWS ap-southeast-2).

1.2 Tender documents, extracted text, evaluation outputs, and account records are stored in Australia. Static assets and edge routing are served through a global CDN.

2. Encryption

2.1 In transit — All traffic between your browser and the Platform is encrypted using TLS 1.2 or higher. HSTS is enabled on the production domain.

2.2 At rest — Database contents and uploaded files are encrypted at rest using AES-256 by the underlying storage layer.

2.3 Secrets — API keys and provider credentials are stored in an encrypted secrets vault and are never exposed to the browser.

3. Access Control & Tenant Isolation

3.1 Every table containing Customer data enforces PostgreSQL Row-Level Security (RLS). Policies restrict reads and writes to members of the owning Organisation, evaluated on every query using the authenticated user's identity.

3.2 Roles are stored in a dedicated user_roles table and checked via a security-definer function, preventing client-side privilege escalation.

3.3 Authentication is handled by Lovable Cloud Auth (email/password with bcrypt-hashed credentials, plus Google OAuth). Sessions use short-lived JWT access tokens with rotating refresh tokens.

3.4 ProcureHQ personnel do not routinely access Customer tender content. Administrative access to production infrastructure is limited to the founder and is used only for support, incident response, or maintenance requested or authorised by the Customer.

4. Evaluation Integrity (Anti-Tamper)

4.1 When a tender is Brief-Locked for evaluation, the Platform computes a SHA-256 fingerprint of the underlying document set. Re-runs are bound to that fingerprint so that Evaluation Output cannot be silently attributed to a different set of source documents.

5. AI Data Handling

5.1 Extraction, scoring, and Committee Findings are generated by large language models accessed through the Lovable AI Gateway (currently Anthropic Claude). Prompts include the tender content required to perform the assessment and are transmitted over TLS.

5.2 Under the applicable API terms, our AI providers do not use Customer inputs or outputs to train their foundation models. Providers may retain requests transiently for abuse-detection purposes only, in accordance with their published policies.

5.3 ProcureHQ does not sell Customer tender data and does not use identifiable Customer content to train third-party models. Aggregated Benchmarking Data is opt-in only and never includes respondent names, pricing, or tender-identifying content (see Privacy Policy Clause 4.1.5).

6. Subprocessors

6.1 We rely on the following subprocessors to operate the Platform:

6.2 We will update this list when subprocessors change. Enterprise Customers may request advance notice of material changes as part of their agreement.

7. Backups & Availability

7.1 The production database is backed up daily by Lovable Cloud with point-in-time recovery available within the retention window provided by the platform.

7.2 The Platform is designed for high availability using managed cloud infrastructure. We do not currently publish a contractual uptime SLA; enterprise SLAs are available on request.

8. Data Retention & Deletion

8.1 Tender documents, evaluations, and account data are retained for the life of your account. On termination or expiry of a subscription you may export your data for thirty (30) days, after which it may be deleted, as described in the Digital Product Terms and the Privacy Policy.

8.2 You may delete individual tenders from within the Platform at any time. To request permanent deletion of your account and associated tender data, contact privacy@procurehq.com.au.

9. Vulnerability Reporting

9.1 If you believe you have found a security vulnerability affecting ProcureHQ, please report it privately to security@procurehq.com.au. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond.

9.2 We will acknowledge legitimate reports promptly, keep you informed of remediation progress, and credit reporters who wish to be named once the issue is resolved.

10. Incident Response

10.1 In the event of a data breach that is likely to result in serious harm to affected individuals, ProcureHQ will notify affected Customers and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

11. Compliance & Certifications

11.1 ProcureHQ operates in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). Our underlying cloud providers hold their own independent certifications (AWS: SOC 2, ISO 27001; Stripe: PCI DSS Level 1). ProcureHQ has not yet obtained its own SOC 2 or ISO 27001 certification.

12. Customer Responsibilities

12.1 To keep your tender data secure, Customers should: use a strong, unique password (or Google sign-in); keep account credentials confidential and limit account access to authorised personnel; and only upload documents you are authorised to share. When multi-user team access is released, remove members promptly when they leave your Organisation.

13. Contact

Security questions: security@procurehq.com.au
Privacy questions: privacy@procurehq.com.au
See also our Privacy Policy and Digital Product Terms.