> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mibyanai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security, credentials, and automation limits

> Protect supplier-portal access, sensitive tender files, approval authority, and external actions

Tender processes sensitive commercial, technical, legal, and access information. Use the controls below together with your organization's security and delegation policies.

## Credentials

* Store supplier-portal credentials only through **Credentials** on the source record.
* Stored secrets are encrypted and are not shown again after saving.
* Use a company-owned account with the minimum required permissions.
* Remove or replace access when ownership changes or credentials expire.
* Never place passwords, API tokens, or OTP codes in notes, proposal text, comments, filenames, or support messages.

<Warning>
  Tender does not bypass CAPTCHA, OTP, supplier registration, or portal terms. When a portal requests human verification, the authorized person must complete it.
</Warning>

## Sensitive tender files

Upload only files needed for the opportunity. Use clear document types and versions, limit workspace membership, and inspect metadata and hidden comments in exported files before external delivery. Tender scans uploaded files before parsing, but your team remains responsible for document classification and access.

## Human approval gates

Explicit human review is required for material Go decisions and exceptions, price or financial commitments, legal deviations, final proposal approval, submission packages, and any external upload, email, or delivery.

AI can summarize, compare, and draft. It does not hold your organization's signing authority or legal responsibility.

## Auditability

Tender records workflow actions, source verification, document processing, proposal revisions, comments, approval decisions, and package activity. Use the activity history to investigate changes and preserve decision context.

## Respond to an access incident

<Steps>
  <Step title="Stop the affected workflow">
    Pause the source or process and do not repeat the login attempt.
  </Step>

  <Step title="Rotate access at the original portal">
    Change the password or revoke the API token at the issuing system.
  </Step>

  <Step title="Remove the stored credential">
    Delete the affected credential from the Tender source.
  </Step>

  <Step title="Review activity">
    Identify the time, user, source, opportunities, and files that may have been affected.
  </Step>

  <Step title="Escalate under company policy">
    Notify your security owner and Mibyan support when necessary without sending the exposed secret.
  </Step>
</Steps>

<CardGroup cols={2}>
  <Card title="Approvals and roles" icon="user-check" href="/tender/approvals-and-roles">
    Review role boundaries and segregation of duties.
  </Card>

  <Card title="Troubleshooting" icon="screwdriver-wrench" href="/tender/troubleshooting">
    Diagnose problems without exposing sensitive information.
  </Card>
</CardGroup>