Security

Where data is stored

• United States data centers operated by our cloud provider, with physical security and SOC 2 audited controls.
• Encrypted in transit (TLS 1.2+) and at rest (AES-256), including file uploads and backups.
• Each company's data is isolated at the row level and enforced on every query, not just in the interface.
• Encrypted backups retained 30 days, with restore drills run quarterly.

Who can see your bids

• Only people you invite, scoped by role: Company Admin, Estimator, Project Manager or Viewer.
• Subcontractors never receive an account and never see a competitor's pricing.
• Evenbid staff access is off by default. Support access requires your request, is time limited and is logged.
• Admin actions, invitations, exports and role changes are recorded in an audit trail you can review.

AI policy

Quote extraction uses AI models to read documents. Your quotes, prices and exclusions are never used to train any model, ours or a vendor's. Data sent for processing is retained by the provider for zero days under a no-training agreement, and results are returned only to your account. We do not build cross-customer pricing benchmarks from your data.

Application security

• Single sign-on (SSO and SAML) available on Enterprise; multi-factor authentication on all plans.
• Least-privilege internal access with mandatory MFA and hardware keys for production.
• Dependency and vulnerability scanning on every deploy; annual third-party penetration testing.
• SOC 2 Type II is in progress. We will share the report and current controls under NDA on request.

Incident response

We monitor for unusual access continuously. If an incident affects your data, we notify affected customers within 72 hours with what happened, what was touched and what we did about it.

Report something

Found a vulnerability, or want our security questionnaire answered? Email johnsonmaurice887@gmail.com and it comes straight to the founder.