🔑
Password hashing
PBKDF2-SHA256 at 600,000 iterations, the count recommended by the OWASP Password Storage Cheat Sheet. No plaintext, no reversible encoding, no MD5.
B2B TRUST, PRE-BUILT
Security
Your customers' proposals, pricing, plan files, and audit history live in BidGlory. We treat that responsibility the way you'd want your own vendors to.
🛡
Breach checking
Have-I-Been-Pwned Pwned-Passwords integration on every password set. Users can't pick a password from a known breach corpus.
🔒
Encrypted secrets
SMTP passwords, API keys, third-party tokens — stored under ASP.NET Data Protection, never plaintext in the database.
👤
Role-based access
Admin / Sales / Install / Portal roles, scoped permissions per area. Install crew can't see margin; portal user can't see other customers.
📜
Audit trail
Every login, every failed login, every bid edit, every proposal export — logged. Know who did what, when, from where.
🗄
Schema migrations
Idempotent SQL migrations with SHA-256 drift detection. Upgrades are safe; your data is stewarded across versions, not stranded.
↪
Portable .bgbid export
You own your data. Round-trip any bid as a portable file for backup, transfer, or offline review — no vendor lock-out.
🏠
Single-tenant deploy
Your company's data lives in your own instance. No shared database, no noisy-neighbor multi-tenant exposure. Self-host or run it managed.
✦
AI stays on your terms
Bring your own LLM endpoint — self-hosted or cloud. No customer data leaves your perimeter unless you point AI at an external provider.
HOW WE APPROACH SECURITY
Most software tells you it’s secure. We can show you.
We use a public standard, not our own opinion.
BidGlory is assessed against OWASP ASVS 5.0 Level 1 for the web application and OWASP MASVS v2 for the iPad app. These are open, published standards written by the application-security community — not a checklist we invented to pass.
Every answer cites its evidence.
The assessment is not a page of reassuring sentences. Each requirement carries a verdict and the exact file and line in our source code that supports it. If you want to know how session handling works, or what happens to an uploaded file, there is a specific answer with a specific location behind it.
The evidence is enforced by the build.
Code moves. Files get split, methods get renamed, and a security claim that was true in March quietly becomes a statement about code that no longer exists — which is worse than no claim, because it still reads as verified. So an automated check runs on every build and fails it if any cited line has drifted. The claim cannot outlive the code it describes.
We record what we have not fixed yet.
An assessment that only lists successes is a brochure. Ours records every requirement we do not currently meet, with the same specificity as the ones we do, and those become tracked work. We would rather tell a customer what is on the list than be asked about it later.
What we do not claim.
OWASP does not certify software, and we will not imply otherwise. We are not SOC 2 audited or ISO 27001 certified, and no third-party penetration test has been performed. If any of those becomes necessary for your organisation, tell us — but we will not print a badge we have not earned.
We’re happy to walk a prospective customer’s IT team through the full assessment under NDA. Ask for it on the demo.
RESPONSIBLE DISCLOSURE
Found something? Tell us.
We take security reports seriously. Email security@bidglory.com with steps to reproduce. We acknowledge within one business day and won't pursue legal action against good-faith research.
★ FREE 30-MINUTE DEMO
See the security model in action.
30 minutes. Free. We'll walk through the audit log, the role model, and the data-export story on your real questions.