Security and your data

Your numbers stay yours.

You're trusting us with your rates, margins and subcontractor prices. Here is exactly where they live, who can see them, and how you take them with you.

Ownership

Your data is yours.

You own everything you put into BidLoop: estimates, rates, programmes, budgets, claims, invoices and cost records. We hold it to run the service, and we don't sell it.

Separation

Each company is walled off.

Every company has its own separate workspace, and access is checked on every request. One company can never see another's numbers, and there's no shared pool of rates or estimates.

Access

You decide who sees what.

Five roles, each with its own signing limit: a site engineer sees their own jobs, a manager approves up to their limit, the accountant runs the books. Permissions and limits are enforced on our servers, so a hidden button is never the only thing stopping someone. Sign-in uses multi-factor authentication, and an audit trail records who approved what, and when.

Protection

Encrypted and monitored.

Your data is encrypted in transit and at rest, and we monitor for errors and unusual activity.

Backups

Backed up every day.

We back up daily and keep each backup for seven days. We've tested restoring from them, so we know they work.

Our team

Access needs a reason, and approval.

Our developers can reach the contents of a workspace only with a director's approval, and only to provide support, investigate a fault or a security issue, or where the law requires it. Other staff see account-level details only: your workspace name, plan, usage and storage.

AI features

A person approves every result.

Some features use AI to read invoices, rate sheets and drawings, and to review estimates. Those documents are processed by our AI provider, which is bound not to use them to train its models. Nothing AI suggests changes a figure until a person approves it, and we record who.

Export

Take it with you, any time.

Export your data to Excel whenever you like while your account is open. If you close your workspace, ask us and we'll make your data available to export for a reasonable period afterwards. After that we delete it, except where the law requires us to keep it or copies remain in routine backups.

Data location

Database and file storage in Australia.

Data held in our database and file storage, including backups, is stored in Australia. Some services that run BidLoop operate overseas: the app's servers, sign-in, AI document reading and error monitoring are in the United States, and email is in Japan, where invoices you forward to us are kept for 30 days. Our Privacy Policy lists each one.

Breaches

If something goes wrong, you hear it from us.

We have procedures to identify and respond to data breaches. If one is likely to cause serious harm, we notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. Where the data is yours, we tell you promptly so you can meet your own obligations.

Certifications

We're not ISO 27001 or SOC 2 certified. We'd rather tell you exactly how your data is handled than show you a badge. If your business needs a security questionnaire filled in, send it to hello@bidloop.com.au and we'll answer it.