Security Manifesto & Accreditation
Speedy Tender (operated by Synthesis Tech Ltd) is engineered from the ground up to handle sensitive UK public sector and corporate bidding data. Certified under the official UK Government-backed Cyber Essentials Scheme (Certificate No: 7b75e963-4228-4c01-8dec-72df148cbe05) with active AIG Cyber Liability Cover & 24/7 Incident Response SLA, our platform enforces multi-tenant database partitioning by organisationId, zero-retention LLM integrations for Velo, mandatory MFA, and granular 5-tier RBAC.
Architectural Foundation: Multi-Tenancy & Trust Invariants
In an enterprise bidding environment, cross-tenant data leakage is an absolute operational failure. Speedy Tender eliminates cross-contamination risks through hard logical partitioning at the database layer. Every database entity, vector embedding, and indexed Knowledge Base artifact is bound to a single verified organisationId.
Server middleware and database security rules validate the user's active session token and matching organisationId before returning any query result or permitting document parsing. Attempting to access data across organisation boundaries results in an immediate authorisation exception logged to our central security audit stream.
Domain Self-Registration & Ingress Controls
When new users register an account matching an enterprise corporate domain (e.g. @company.co.uk), they are placed into a restricted PendingApproval state by default. Self-registered users cannot view active tenders, access the Knowledge Base, or run Velo AI operations until an Organisation Admin manually elevates their authorisation state.
Five-Tier Role-Based Access Control (RBAC) Hierarchy
To provide fine-grained governance across complex bidding teams, Speedy Tender enforces a rigid 5-tier role hierarchy. Roles dictate feature access, administrative rights, Knowledge Base editing privileges, and AI operational capabilities.
Full administrative authority, subscription ownership, domain security management, and master organisation audit log access.
User onboarding elevation from PendingApproval, role assignments, security policy enforcement, Knowledge Base root management, and team allocation.
Creation and assignment of tender projects, workflow checklist progression, task assignment, review cycle management, and submission validation.
Active proposal co-drafting, leveraging Velo AI assistance, querying Knowledge Base evidence, drafting response sections, and updating task statuses.
Complimentary read-only access for internal executives, legal advisors, external compliance auditors, and subject matter reviewers. Reviewers can inspect proposals, add comments, and approve compliance checks, but are strictly prohibited from mutating core tender documents or triggering automated AI operations.
Operational Safeguards & Velo Role Controls
To preserve document integrity and enforce strict operational boundaries, Speedy Tender applies granular role-based guardrails around high-grade analytical services. Execution of Velo AI generation, deep vector indexing, automated specification parsing, and compliance gap analysis is restricted to active writing and management seats.
Guest Reviewers maintain read-only access to inspect proposals and review compliance checks without permission to mutate workspace data or initiate automated AI co-drafting routines.
Enforced Reviewer Authorisation Response
When a user in a Reviewer seat attempts to execute a Velo AI generation, document parsing sequence, or automated gap analysis, the backend server middleware immediately intercepts the request and aborts execution before invoking AI services:
Data Sovereignty & Model Training Opt-Outs
Public sector tenders often contain sensitive UK sovereign data, defence specifications, and confidential healthcare protocols. Speedy Tender operates under strict UK data residency and privacy invariants:
All primary Firestore databases, vector indices, document stores, and application servers are hosted exclusively within Google Cloud UK (London) data centres (europe-west2), ensuring complete compliance with UK GDPR and Crown Commercial Service guidelines.
All Velo AI co-drafting interactions utilise enterprise-tier API agreements with 100% data retention opt-outs. Your proprietary tender responses, Knowledge Base evidence, and organisational IP are never stored by AI providers or used to train public foundation models.
Multi-Factor Authentication (MFA) is strictly enforced across all user accounts without exception, ensuring robust identity verification and protecting workspace ingress against unauthorised access.
User session tokens enforce a mandatory 12-hour expiration time-to-live (TTL). All data at rest is encrypted using AES-256 standards, while data in transit is secured via TLS 1.3 encryption.
Cyber Essentials Accreditation & AIG Cyber Risk Indemnity
To provide ultimate transparency for UK public sector bodies, NHS trusts, and enterprise bidding departments, Synthesis Tech Ltd (operator of Speedy Tender) has achieved official Cyber Essentials Certification under the UK National Cyber Security Centre (NCSC) framework.
The 5 Core Cyber Essentials Safeguards Implemented
All network boundaries are protected by hardware and cloud security rules, isolating application clusters and preventing unauthorized ingress.
Servers and cloud components operate under strict infrastructure-as-code baseline configurations, disabling unused ports and default guest accounts.
Access to admin functions and user accounts requires mandatory Multi-Factor Authentication (MFA) and 5-tier role-based access restrictions.
Continuous endpoint protection, automated file payload scanning, and browser sandboxing prevent malicious code execution.
AIG Cyber Liability Cover & 24/7 First Response Incident SLA
Policy Number: 0038323276 • Master Policy: 38181000
To complement our Cyber Essentials technical perimeter, Synthesis Tech Ltd maintains active Cyber Liability Cover underwritten by American International Group UK Limited (AIG / Policy No. 0038323276).
Rather than relying on passive protection, this cover integrates a mandatory 1-hour SLA with AIG’s First Response Service (+44 (0)1273 730992). In the event of a suspected incident, dedicated IT forensics specialists (Grant Thornton) and legal counsel (CMS Cameron McKenna) deploy immediately to contain threats, restore systems, and ensure operational continuity for our enterprise client workspaces.
Enterprise Security & Governance by Design
Discover how our zero-trust architecture, multi-tenant database partitioning, and Velo AI co-drafting safeguards provide total data privacy for enterprise bidding teams.