Skip to main content
Tender processes sensitive commercial, technical, legal, and access information. Use the controls below together with your organization’s security and delegation policies.

​
Credentials

  • Store supplier-portal credentials only through Credentials on the source record.
  • Stored secrets are encrypted and are not shown again after saving.
  • Use a company-owned account with the minimum required permissions.
  • Remove or replace access when ownership changes or credentials expire.
  • Never place passwords, API tokens, or OTP codes in notes, proposal text, comments, filenames, or support messages.
Tender does not bypass CAPTCHA, OTP, supplier registration, or portal terms. When a portal requests human verification, the authorized person must complete it.

​
Sensitive tender files

Upload only files needed for the opportunity. Use clear document types and versions, limit workspace membership, and inspect metadata and hidden comments in exported files before external delivery. Tender scans uploaded files before parsing, but your team remains responsible for document classification and access.

​
Human approval gates

Explicit human review is required for material Go decisions and exceptions, price or financial commitments, legal deviations, final proposal approval, submission packages, and any external upload, email, or delivery. AI can summarize, compare, and draft. It does not hold your organization’s signing authority or legal responsibility.

​
Auditability

Tender records workflow actions, source verification, document processing, proposal revisions, comments, approval decisions, and package activity. Use the activity history to investigate changes and preserve decision context.

​
Respond to an access incident

1

Stop the affected workflow

Pause the source or process and do not repeat the login attempt.
2

Rotate access at the original portal

Change the password or revoke the API token at the issuing system.
3

Remove the stored credential

Delete the affected credential from the Tender source.
4

Review activity

Identify the time, user, source, opportunities, and files that may have been affected.
5

Escalate under company policy

Notify your security owner and Mibyan support when necessary without sending the exposed secret.

Approvals and roles

Review role boundaries and segregation of duties.

Troubleshooting

Diagnose problems without exposing sensitive information.