Create your account
Set up for free — pay only when you open a tender.
Already have an account? Sign in
Security Statement
How TenderBox handles your data.
TenderBox is operated by Beyond Condition Pty Ltd (ABN 33 139 306 360), registered in Queensland, Australia.
Hosting & data location
TenderBox is hosted on servers located in Sydney, Australia. All data — including tender documents, bid submissions, and bidder information — is stored and processed exclusively within Australia. All data is transmitted over encrypted connections (HTTPS/TLS). Australian data residency means your data never leaves Australian jurisdiction in the ordinary course of operations, directly satisfying data sovereignty requirements for government and corporate clients.
Third-party subprocessors
TenderBox uses the following third-party services. No other parties receive your data.
- Anthropic (Claude AI) — opt-in only, United States. The AI co-evaluator is an optional feature. If it is not activated, no tender documents or bid content are ever transmitted to Anthropic. Anthropic holds ISO 27001 and SOC 2 Type II certifications.
- SMTP2GO — email delivery, Australia. Used solely to deliver transactional emails (invitations, bid confirmations, Q&A notifications). Receives recipient addresses and message content for delivery only.
- Mattermost — internal notifications, self-hosted by Beyond Condition. Used for internal operational alerts. Receives event metadata (event type, tender name) only. No document content is transmitted.
Staff access controls
Access to production infrastructure is restricted to authorised Beyond Condition personnel only. No staff member accesses production data without a logged business reason.
Sealed bid probity
TenderBox enforces sealed bids by design — bid details are hidden to all parties until the tender formally closes. Every platform event (document uploads, invitations, bid submissions, evaluations, exports) is timestamped and recorded in an immutable audit log, exportable as Excel for probity review.
Data retention & deletion
When a tender is deleted, all associated bid submissions and bidder personal information are removed from our active database. Residual copies in encrypted backups are purged within 120 days.
Compliance
Beyond Condition complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Our full Terms & Privacy notice is available at beyondcondition.com/terms.
Security governance & ISO 27001 pathway
TenderBox is built with information security governance in mind from day one. We use ISO-accredited infrastructure — Anthropic (our optional AI co-evaluator) holds ISO 27001 and SOC 2 Type II certifications; our email relay, SMTP2GO, operates from Australia under equivalent standards.
Beyond Condition is on a 12–18 month pathway to ISO 27001 certification — the internationally recognised standard for information security management systems (ISMS). ISO 27001 requires an independent audit of security controls, risk management processes, and data handling practices by an accredited certification body. Our commitment to this pathway reflects the reality that the clients our users serve — in construction, property, and government procurement — increasingly require formal evidence of information security governance. We are building toward it now rather than retrofitting it later.
Contact
Privacy enquiries: [email protected]. Security enquiries: [email protected]