Your Company’s Work, with Accountable Access
Understand the controls available today and the setup required for your organization’s security requirements.
Company Boundaries and Roles
Company membership and role permissions control access to profiles, relationships, private documents, bid decisions and responses. Server checks and scoped database policies enforce these boundaries. Authorized administrators can manage assigned companies; platform administrators have broader access. Public opportunity and market datasets are shared across the platform.
Sign-In and Enterprise Setup
Web users can add an authenticator app to their account. Company-wide MFA enforcement requires a coordinated rollout across web, mobile and connected tools. Customer SAML sign-in and SCIM directory connectors are prepared for approved provider setup and testing; they are inactive by default. Domain matching alone never grants company access. Passkeys are not currently available.
We review provider trust, existing memberships, recovery access and any provider costs with your administrators before activation. Saving setup details does not turn on a connector. Plan Enterprise Access.
API Keys and Connected Tools
Personal API keys act as their creating user and recheck the account’s current company permissions. The full key is shown once; the platform stores a hash and prefix. Revoke keys in Settings → API Keys & MCP. Approved OAuth connections use explicit company consent and scoped access, and can be revoked in Developer Connections. Writes through the REST API and OAuth MCP require a preview and confirmation; personal-key MCP follows each tool’s confirmation rules.
Activity and Retention
Platform administrators can search and export operational activity records. New events identify their company when that context is known; older unattributed records remain separate. Activity logging is best effort and is not a complete or tamper-proof compliance archive.
Administrators can prepare an audit retention policy, apply a legal hold and preview eligible records. Automatic deletion is not active. Document, provider-log and backup retention requirements need their own review.
AI Processing and Customer Data
Scoring and drafting send relevant solicitation, company and response material to commercial AI services. Review our Privacy Policy for the published data-processing policy. Ask us to confirm provider terms, retention settings and your data-handling requirements before uploading restricted material.
Exports and Cancellation
Contact us to request an export or deletion of company data, including after cancellation. We will confirm scope, format and retention requirements with you. See the Privacy Policy and Terms of Service.
Review Your Requirements with Us
Bring required certifications, hosting constraints, retention periods and access policies to onboarding. IFX Bid does not currently claim FedRAMP authorization, CMMC certification, a dedicated GovCloud deployment, an independent penetration test or a contractual uptime SLA. These require separate infrastructure, assessment or commercial work. Discuss Security Requirements.
Bring Us a Bid You Would Actually Pursue
Walk through your sources, supplier workflow and response requirements with us before deciding whether IFX Bid fits your desk.