How Bid Now protects a public bid.
A plain-language reference for procurement, IT, and security reviewers evaluating Bid Now for a government, school, or public agency.
In one paragraph
The short version
Bid Now is a self-hostable WordPress application for sealed electronic bidding and reverse auctions. It is built so that a sealed bid stays sealed until its scheduled opening, so that the record of what happened cannot be quietly altered, and so that each agency keeps its own data on its own (or its host’s) infrastructure. Authentication, authorization, data handling, and auditing are enforced in the application’s server-side code — not left to the interface. This document summarizes those controls, what data the system holds, how long it keeps it, and what the hosting environment is responsible for. For the current status of any specific capability or its roadmap, contact us as part of your evaluation.
Data ownership is the design premise. Bid Now runs on the agency’s own WordPress site or on managed hosting operated on the agency’s behalf. Bid data, documents, and the audit trail live in that installation’s database and file storage — not in a shared multi-tenant cloud outside the agency’s control.
Control summary
01Core safeguards at a glance
The controls a reviewer usually asks about first. Each is described in more detail in the sections that follow.
Sealed-bid confidentiality In place
Bid amounts, files, and signatures are withheld from everyone — including agency staff — until the scheduled opening time.
Tamper-evident opening In place
Opening a lockbox early is permanently recorded (account, time, IP) and cannot be deleted, even by a site administrator.
Server-enforced authorization In place
Every sensitive action re-checks the user’s permission for that specific solicitation in the data layer, not just the UI.
Staff multi-factor auth In place
Optional TOTP two-factor for staff, enforceable by role, with encrypted secrets and hashed single-use recovery codes.
Parameterized data access In place
All custom database queries use prepared statements; output is escaped; spreadsheet-formula injection in exports is neutralized.
Protected file storage In place
Uploaded bid and credential files are stored with randomized names, restricted permissions, and download authorization on every request.
Full audit trail In place
Requests, submissions, reviews, awards, and openings are logged and exportable for the record.
Records export & portability In place
Solicitation, bid, and audit records can be exported so an agency can satisfy public-records requests and keep its own copies.
Confidentiality
02Keeping a sealed bid sealed
The integrity of a sealed bid process depends on no one — not a competitor, and not the issuing staff — seeing a submission before the official opening. Bid Now enforces this in code:
- Sealed bid amounts, uploaded packages, and signatures are redacted from query results until the solicitation’s scheduled opening time, or a properly authorized early opening.
- A vendor can see only their own submission before opening; no path returns another vendor’s sealed contents early.
- An early opening requires authorization for that specific solicitation and is written to a permanent record — account, timestamp, and IP — that is protected against deletion and modification at the database and metadata layer, including from site administrators.
- Live reverse auctions intentionally show current low pricing (that is how a reverse auction works) but never expose competing vendors’ identities to each other.
Access & identity
03Authentication & authorization
Authorization
Permissions are organization-scoped: staff can act only on solicitations belonging to organizations they administer. These checks run in the application’s model layer, so changing an identifier in a request cannot reach another organization’s data. Site administration and vendor roles are distinct, and the system does not grant elevated privileges implicitly.
Authentication
- Passwords use WordPress’s native hashing and password-reset mechanisms; reset flows do not reveal whether an account exists, and password emails are rate-limited.
- Multi-factor (TOTP) is available for staff, can be required for organization administrators, stores the authenticator secret encrypted at rest, provides hashed single-use recovery codes, and rate-limits verification attempts. The login is held before any session is established until the second factor is verified.
Application security
04Data handling & hardening
- Database access — all custom queries are parameterized (prepared statements) against a fixed table whitelist; no user input is concatenated into SQL.
- Output — values are escaped at the point of output; the interface does not render untrusted content as markup.
- Request handling — staff actions require both a valid nonce (CSRF protection) and a capability check; inputs are sanitized on the way in.
- File uploads — restricted to an allowed document/image type list, stored outside the public content flow with randomized filenames and owner-only permissions, and streamed only after a per-file authorization check that confirms the requester may see that specific file. Path-traversal is prevented by canonical-path containment.
- Exports — CSV cells are protected against spreadsheet-formula injection so a crafted vendor entry cannot execute when staff open an export.
- Secrets — MFA secrets are encrypted with a site-held key; recovery codes are stored only as hashes.
Privacy
05What data is held, and external services
Data the system holds
Vendor company and contact details; uploaded documents and technical proposals; digital signatures; submission IP addresses; bid amounts and line items; questions and staff answers; and optional bid-notice category and location preferences. Bid Now serves no advertising and includes no third-party analytics or tracking.
External services
WordPress privacy tools
Bid Now integrates with WordPress’s built-in personal-data export and erasure tools and registers suggested privacy-policy text, so a site owner can meet data-subject requests through the standard WordPress workflow.
The record
06Auditability & records retention
Public procurement is a matter of record, and Bid Now is built to preserve that record rather than to quietly discard it.
- Audit log — specification and credential requests, submissions, credential reviews, questions and answers, awards, and lockbox openings are logged with timestamps and are exportable to CSV for the file.
- Immutable openings — early-opening records are protected against deletion or alteration by design.
- Retention — bid and solicitation records are retained in the agency’s installation; nothing is silently purged. Site owners control retention to match their public-records obligations, and the uninstall data-removal behavior is an explicit, opt-in setting.
- Portability — records can be exported so an agency can satisfy public-records / FOIA requests and retain its own copies.
Legal standing
07Electronic signatures
Vendors sign submissions either by drawing a signature or by typing their full legal name; both are captured as part of the submission. Under the U.S. ESIGN Act and UETA, an electronic signature is valid when there is intent to sign, association of the signature with the record, and a retained record of the transaction. Bid Now supports all three: the signer takes a deliberate signing action, the signature is stored with the specific bid or credential submission, and the submission — with its timestamp, submitting account, and IP — is retained in the audit trail. Agencies should confirm this meets their jurisdiction’s specific procurement-signature rules.
Accessibility
08Section 508 / WCAG
Bid Now has undergone an accessibility remediation pass toward WCAG 2.1 Level AA — including keyboard-operable forms, a keyboard- and screen-reader-accessible signature option, announced status messages, labeled controls, and sufficient color contrast. Agencies can request the current accessibility conformance report (VPAT) as part of an evaluation.
Maintenance
09Updates & vulnerability handling
Bid Now is released under semantic versioning with a public changelog. Security fixes are issued as prompt point releases and delivered to licensed installations through the update channel; managed-hosting customers receive them applied on their behalf. Suspected vulnerabilities can be reported to the vendor for coordinated resolution.
Shared responsibility
10What the hosting environment must provide
Bid Now secures the application; the surrounding environment secures the platform. For a self-hosted deployment, the site owner is responsible for the items below. On Bid Now managed hosting, the vendor configures them.