Security

Your data. Your region. Your rules.

Built for IT teams that need to sign off with confidence. Data residency, encryption, RBAC, and immutable audit — from day one.

AES-256

At rest

TLS 1.3

In transit

7 years

Audit retention

7 roles

RBAC enforced

WHAT THIS MEANS FOR YOUR ORGANISATION

TenderEdge was built to satisfy enterprise IT and legal requirements from the ground up. Data stays in your region. Access is controlled by role, not by trust. Every action is permanently logged with before-and-after values. Your organisation is audit-ready from day one — not after a compliance project.

DATA RESIDENCY

Your data stays where you put it.

Deploy in any Azure region worldwide. For Middle Eastern operators, data stays in-region — fully compliant with Saudi Arabia's Personal Data Protection Law (PDPL) and ZATCA requirements. No cross-border data transfer without explicit consent.

Choose your Azure deployment region
PDPL (Saudi Personal Data Protection Law) compliant
ZATCA regulatory compliance
No cross-border data transfer
Regional backup and disaster recovery

Infrastructure

ApplicationAzure App Service
B1 / B2
DatabaseAzure PostgreSQL Flexible
Burstable B1ms
CacheAzure Cache for Redis
Basic C0
AuthKeycloak on App Service
B1
StorageAzure Blob Storage
Hot / LRS
MonitoringAzure App Insights
Free 5GB/mo

ACCESS CONTROL

7-Role RBAC with Data Scope

Every role has precisely defined permissions. Data scope enforcement ensures users see only what they should.

System Administrator — full config, no operational data

Section Head — all data, approvals, reports

Contract Administrator — own assigned items only

Executive Director — own business line, read-only

JTC Member — JTC-flagged items only

Auditor — full read + audit trail, no modify

PULSE Consultant — managed service, no approvals

AUDIT TRAIL

Immutable. 7-Year Retention.

Every action logged. No exceptions. No overrides.

Who performed the action (user ID, role at time)
What changed (before and after JSON values)
When it happened (UTC millisecond timestamp)
Where from (IP address)
Append-only — no UPDATE or DELETE on audit table
Auditor access is itself logged
Export as CSV (export event logged)

Questions about security?

Our team is ready to walk through data residency, compliance, and architecture with your IT team.