Security
Built to be signed off by IT and Security.
What protects your data, stated exactly — including what we do not yet claim.
No passwords, anywhere
Sign-in is a six-digit code sent to a work mailbox, valid for ten minutes, with limited attempts and resends. Nobody registers themselves: an administrator invites every user.
Each role sees its own slice
Every query is scoped to your organisation, and within it to the role: a Contract Admin sees the contracts assigned to them, an Executive sees their business line.
The vendor cannot read your data
PULSE's platform administration is separated from your workspace. A platform sign-in carries no access to tenant records, and user management inside your organisation belongs to your own administrator.
A record that is not rewritten
Activity notes and phase decisions cannot be edited or deleted from the application, and report generation, imports and skipped rows are recorded.
Uploads checked by content
Tender documents are checked by their content, not their file name, and capped at 20 MB.
Encrypted in transit and at rest
Served over HTTPS only. Data at rest is encrypted by the hosting platform — in your jurisdiction, or on your own servers.
Personal data
Under the PDPL, compliance is shared — and we say which part is whose.
You — controller
Decide why data is held and for how long, hold the SDAIA registration, and decide requests from individuals.
PULSE — processor
Handle your data only on your written instructions, disclose every sub-processor, and notify you in time for the 72-hour breach duty.
Cloud provider — infrastructure
The licensed in-Kingdom region and its own audited certifications. On-premise, this row is yours.
Certifications
TenderEdge does not hold a SOC 2 or ISO 27001 certificate today. We would rather say so than print a badge.
Bring your questions to a security review.
We will walk your IT and Security team through access, residency and the shared-responsibility split.