Security
Every control on this page is enforced by the product today, and every status is dated. Where AwardBeam does not hold a certification yet, the table says so in plain words.
Demonstration data. The City of Westbridge is a fictional municipality.
Controls
Each statement describes the current release and is backed by the product itself. Where a control has a limit, the limit is written next to it.
Enforced in the database
Before the opening, bid contents are unreadable to every staff account, administrators included. Administrators see a count and the time each bid arrived. The opening can be recorded only after the deadline, only once, and only through the product.
Enforced in the database
Access rules live in the database itself. Whether a request comes from a screen or goes straight to the database, the database decides what that account may read, so a direct request gets nothing a screen would refuse.
Staff accounts
Recording a bid opening, downloading a bid file, publishing an award and opening the audit log each require a code from the staff member's authenticator app. So do changes to approval rules, staff roles and the idle limit.
Enforced in the database
Every recorded action is appended with who did it and when, and keeps the values before and after. The database refuses to change or delete an entry for every application account, including administrators and the service key.
Product setting
Staff sessions sign out after 30 minutes without activity by default. An administrator can set the limit anywhere from 5 to 120 minutes. It is a product setting.
Enforced in the database
Each submission is saved as a version with a confirmation number, a server timestamp and a SHA-256 content hash. A recorded version cannot be edited, and confirmation numbers are never reused.
Enforced in the product
Downloads of bid files, solicitation documents, addenda, contracts, vendor compliance files and protest documents record who downloaded which file, and when.
Enforced by the sign-in form
Five failed sign-ins for one address inside fifteen minutes lock it for fifteen minutes, for staff and contractor accounts alike. The answer is the same whether or not an account exists, and a staff lock is written to the audit trail.
Enforced in the product
Every upload is opened and checked. Programs and scripts are refused whatever their name, and so are web pages, macro-enabled Office files, archives that hold a blocked file, and files whose contents do not match their extension.
Demonstration data. The City of Westbridge is a fictional municipality.
Sealed bids
Before the deadline, an administrator sees a count and the time each bid arrived, and nothing else. The deadline passing opens nothing. Contents unlock only when an authorized officer records the opening, which takes an authenticator code and can happen once.
See the bid opening on the product pageDemonstration data. The City of Westbridge is a fictional municipality.
Audit trail
Every recorded action is appended with who did it, when, and the values before and after. The database refuses to change or delete an entry for every application account, administrators and the service key included.
Demonstration data. The City of Westbridge is a fictional municipality.
Status
Every row carries the same date. Where AwardBeam has no certification or has not completed a review, the row says so in the same words a security questionnaire uses.
Status as of September 2026
On every table, so a direct request to the database gets no more than a screen would show.
Also required to change approval rules, staff roles or the idle limit. Contractor accounts are not asked to enroll.
The database refuses edits and deletes, including from administrators and the service key.
An administrator can set 5 to 120 minutes. It is a product setting.
Applies to staff and contractor accounts in the sign-in form. The same answer is given whether or not an account exists.
Content inspection, not antivirus scanning: it stops the file types used to deliver malware.
Staff sign in with an email address and password.
See the accessibility statement.
AwardBeam holds procurement records, not criminal justice information.
Data classification
Most procurement records become public once an award is published. These are the exceptions, and the database enforces each rule.
| Record | Who can read it | When that changes | What the public sees |
|---|---|---|---|
| Unopened bids | Administrators see a count and the time each bid arrived. Evaluators see nothing. Each bidder sees only its own bid. | After the deadline passes and an authorized officer records the opening with an authenticator code, once. Then administrators read all bids, and assigned evaluators read them after a cleared conflict declaration. | After award Bid amounts on the award page. Sealed bids are left out of records packets and exports. |
| Price envelopesTwo-envelope solicitations | Nobody, after the technical opening. Technical answers and files are readable. Amounts are not shown, and bids are not ranked by price. | A separate price opening, recorded after the technical opening. An award cannot be made while prices are sealed. | After award Prices on the award page. |
| Evaluator scores and notes | Each evaluator reads their own. Administrators read the whole panel's. | Individual scores and notes stay internal after the award. | Averages after award Committee averages by criterion, from submitted scorecards. Individual notes are never public. |
| Taxpayer IDs | The vendor profile stores only the last four digits of an EIN or TIN. The vendor reads its own. Staff read it for vendors their agency has a bid, invitation or contract with, or that are new to the platform. | Does not change. | Never public Left out of public pages, records packets and exports. |
| Government estimates | Any staff account in your agency. | When the award is published, the estimate is copied to the public award page. | After award The estimate on the award page. An estimated range appears on the opportunity page only if your agency publishes one. |
| Audit log | Administrators in your agency, after confirming an authenticator code. | Does not change. | Never public |
Bid amounts on the award page. Sealed bids are left out of records packets and exports.
Two-envelope solicitations
Prices on the award page.
Committee averages by criterion, from submitted scorecards. Individual notes are never public.
Left out of public pages, records packets and exports.
The estimate on the award page. An estimated range appears on the opportunity page only if your agency publishes one.
Gaps
IT reviewers ask about these first, so each one is listed here with what happens today. The security packet lists every known limitation and its planned fix, including ones that are not published on this page.
Today: Staff sign in with an email address and password. There is no connection to your agency's identity provider yet.
Today: Contractor accounts sign in with a password only. They are not asked to enroll, including when they download their own bid files.
Reporting and review
Use the contact form. There is no public security mailbox, and the site's security.txt file points to the same form. Include what you found, the steps to reproduce it and the page involved. Please do not access or change data that is not yours.
The security.txt file lists the contact form as the contact, expires on September 24, 2027, prefers English and names this page as the policy.
For IT and legal review
The packet includes the subprocessor list: the companies that host or process data for AwardBeam. There is no NDA to click through before you ask. If your agency has its own security questionnaire, send it with the request.